CVE-2025-0411highunder attackCWE-693

CVE-2025-0411: high-severity vulnerability in 7-Zip

7-Zip Mark-of-the-Web Bypass Vulnerability

Published · Updated

Follow this CVE+ Monitor 7-Zip

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7epss 48%
from disclosure to weaponsame day
Published on NVDJan 25
1st PoCJan 22
CISA KEV+12d
Action required by CISAfederal deadline: 2025-02-27

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

7-Zip fails to preserve the Mark-of-the-Web safety marker when extracting files from archives, allowing attackers to extract malicious files that bypass Windows security warnings and execute arbitrary code.

Technical detail

This vulnerability exploits insufficient Mark-of-the-Web propagation in 7-Zip's archive extraction routine (CWE-693: Improper Neutralization of equivalent elements in data queries). An attacker distributes a crafted archive; when a user extracts it, the MOTW attribute is not transferred to extracted files, enabling execution of untrusted code without security prompts. Requires user interaction to extract the malicious archive.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
7-Zip · 7-Zip
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — 7-Zip

In the same product, most dangerous first.

CVE-2025-11001HIGH7-Zip ZIP File Parsing Directory Traversal Remote Code Execution VulnerabilityEPSS 27.4%CVE-2024-11477HIGH7-Zip Zstandard Decompression Integer Underflow Remote Code Execution VulnerabilityEPSS 22.4%CVE-2023-40481HIGH7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 13.8%CVE-2024-11612MEDIUM7-Zip CopyCoder Infinite Loop Denial-of-Service VulnerabilityEPSS 1.9%CVE-2025-55188LOWCVE-2025-55188EPSS 1.0%CVE-2026-14266HIGH7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%