7-zip vulnerabilities

Products

• 7-zip 34
• P7zip 6
• 7zip 2

Newest

• 7-zip 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table CVE-2026-104086 Fix available 6.8 MediumOctober 14, 2026
• 7-zip 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-14266 Public exploitFix available 7.0 HighJuly 21, 2026
• 7-zip 7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision CVE-2026-58052 Fix available 4.8 MediumJune 28, 2026
• 7-zip GHSL-2026-122 7-Zip Ar SYMDEF OOB Read CVE-2026-48112 Fix available 6.5 MediumJune 5, 2026
• 7-zip GHSL-2026-121 7-Zip UEFI DEPEX OOB Read CVE-2026-48111 Fix available 4.3 MediumJune 5, 2026
• 7-zip GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read CVE-2026-48104 Fix available 4.2 MediumJune 5, 2026
• 7-zip GHSL-2026-119 7-Zip WIM SecurityId OOB read CVE-2026-48103 Fix available 4.3 MediumJune 5, 2026
• 7-zip GHSL-2026-118: 7-Zip UDF Field OOB Read CVE-2026-48102 Fix available 3.1 LowJune 5, 2026
• 7-zip GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure CVE-2026-48101 Fix available 6.5 MediumJune 5, 2026
• 7-zip 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) CVE-2026-48092 Fix available 4.3 MediumJune 5, 2026
• 7-zip GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation CVE-2026-48095 Public exploitFix available 8.8 HighJune 3, 2026
• andybalholm brotli, 7-zip p7zip, anthropic bun +39 more +41 more Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 In KEVPublic exploitFix available EPSS 82.6% 9.2 CriticalApril 27, 2026
• 7-zip 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability CVE-2025-11002 Fix available 7.0 HighJanuary 23, 2026
• 7-zip 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability CVE-2025-11001 Public exploitFix available EPSS 27.4% 7.0 HighNovember 19, 2025
• 7-zip 7-Zip before 25.01 does not always properly handle symbolic links during extraction. CVE-2025-55188 Public exploitFix available 3.6 LowAugust 8, 2025
• 7-zip GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream CVE-2025-53817 Fix available 5.5 MediumJuly 17, 2025
• 7-zip GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder CVE-2025-53816 Fix available 5.5 MediumJuly 17, 2025
• 7-zip 7-Zip through 24.09 does not report an error for certain invalid xz files, involving stream flags... CVE-2022-47112 Fix available 2.5 LowApril 19, 2025
• 7-zip 7-Zip through 24.09 does not report an error for certain invalid xz files, involving block flags... CVE-2022-47111 Fix available 2.5 LowApril 19, 2025
• 7-zip, netapp active iq unified manager +1 more 7-Zip Mark-of-the-Web Bypass Vulnerability CVE-2025-0411 In KEVPublic exploit EPSS 47.6% 7.0 HighJanuary 25, 2025
• 7-zip, 7-zip 7zip +1 more 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability CVE-2024-11477 Public exploitFix available EPSS 22.4% 7.8 HighNovember 22, 2024
• 7-zip 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability CVE-2024-11612 Fix available 6.5 MediumNovember 22, 2024
• 7-zip The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read... CVE-2023-52169 Fix available 8.2 HighJuly 3, 2024
• 7-zip 7zip The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer... CVE-2023-52168 Fix available 8.4 HighJuly 3, 2024
• 7-zip 7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability CVE-2023-40481 Fix available EPSS 13.8% 7.8 HighMay 3, 2024
• 7-zip, netapp active iq unified manager, oncommand workflow automation +2 more 7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z... CVE-2023-31102 Fix available EPSS 54.0% 7.8 HighNovember 3, 2023
• 7-zip p7zip p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function... CVE-2022-47069 Fix availableDisputed 7.8 HighAugust 22, 2023
• 7-zip 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with... CVE-2022-29072 Public exploitDisputed 7.8 HighApril 15, 2022
• 7-zip Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage... CVE-2018-10115 Fix available 7.8 HighMay 2, 2018
• 7-zip 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the... CVE-2018-10172 Disputed 8.8 HighApril 16, 2018
• 7-zip, 7-zip p7zip, debian linux +2 more Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18... CVE-2018-5996 Fix available 7.8 HighJanuary 31, 2018
• 7-zip, 7-zip p7zip, debian linux +2 more Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before... CVE-2017-17969 Fix available 7.8 HighJanuary 30, 2018
• igor pavlov 7 zip for windows, 7-zip +1 more Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote... CVE-2016-7804 7.8 HighMay 22, 2017
• 7-zip, fedoraproject fedora, oracle solaris +2 more Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before... CVE-2016-2334 Public exploitFix available EPSS 14.7% 7.8 HighDecember 13, 2016
• 7-zip p7zip A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null... CVE-2016-9296 Fix available 7.5 HighNovember 12, 2016
• 7-zip, debian linux, opensuse +2 more The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and... CVE-2016-2335 Fix available 8.8 HighMay 21, 2016
• 7-zip p7zip, fedoraproject fedora, oracle solaris +2 more p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. CVE-2015-1038 Fix available 5.8 MediumJanuary 21, 2015
• 7-zip Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as... CVE-2008-6536 Fix available 10.0 HighMarch 30, 2009
• 7-zip Stack consumption vulnerability in AkkyWareHOUSE 7-zip32.dll before 4.42.00.04, as derived from... CVE-2007-4725 Public exploit 6.8 MediumSeptember 5, 2007