CVE-2025-0411
7-Zip Mark-of-the-Web Bypass Vulnerability
In short
7-Zip fails to preserve the Mark-of-the-Web safety marker when extracting files from archives, allowing attackers to extract malicious files that bypass Windows security warnings and execute arbitrary code.
Technical detail
This vulnerability exploits insufficient Mark-of-the-Web propagation in 7-Zip's archive extraction routine (CWE-693: Improper Neutralization of equivalent elements in data queries). An attacker distributes a crafted archive; when a user extracts it, the MOTW attribute is not transferred to extracted files, enabling execution of untrusted code without security prompts. Requires user interaction to extract the malicious archive.
Summary generated and translated by AI from the official description.
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
7-Zip · 7-Zippublic PoCs found — 6
githubgithub.com/dhmosfunk/7-Zip-CVE-2025-0411-POC★ 155githubgithub.com/cesarbtakeda/7-Zip-CVE-2025-0411-POC★ 2githubgithub.com/iSee857/CVE-2025-0411-PoC★ 1githubgithub.com/ishwardeepp/CVE-2025-0411-MoTW-PoC★ 1githubgithub.com/betulssahin/CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass★ 0githubgithub.com/RustMacrosRecoil/7-Zip-CVE-2025-0411-POC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://security.netapp.com/advisory/ntap-20250207-0005/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0411https://www.vicarius.io/vsociety/posts/cve-2025-0411-7-zip-mitigation-vulnerabilityhttps://www.vicarius.io/vsociety/posts/cve-2025-0411-detection-7-zip-vulnerabilityhttps://www.zerodayinitiative.com/advisories/ZDI-25-045/http://www.openwall.com/lists/oss-security/2025/01/24/6