CVE-2025-55188: falha de baixa gravidade em 7-Zip
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.6epss 1.0%
7-Zip before 25.01 does not always properly handle symbolic links during extraction.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Produtos afetados
7-Zip · 7-ZipCVEs relacionadas — 7-Zip
No mesmo produto, das mais perigosas para as menos.
CVE-2025-0411HIGH7-Zip Mark-of-the-Web Bypass VulnerabilityEPSS 47.6%KEVCVE-2025-11001HIGH7-Zip ZIP File Parsing Directory Traversal Remote Code Execution VulnerabilityEPSS 27.4%CVE-2024-11477HIGH7-Zip Zstandard Decompression Integer Underflow Remote Code Execution VulnerabilityEPSS 22.4%CVE-2023-40481HIGH7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 13.8%CVE-2024-11612MEDIUM7-Zip CopyCoder Infinite Loop Denial-of-Service VulnerabilityEPSS 1.9%CVE-2026-14266HIGH7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution VulnerabilityEPSS 0.7%
Referências
https://github.com/ip7z/7zip/compare/25.00...25.01https://github.com/ip7z/7zip/releases/tag/25.01https://github.com/lunbun/CVE-2025-55188/https://lunbun.dev/blog/cve-2025-55188/https://sourceforge.net/p/sevenzip/discussion/45797/thread/da14cd780b/https://www.openwall.com/lists/oss-security/2025/08/09/1https://www.vicarius.io/vsociety/posts/cve-2025-55188-detect-7-zip-vulnerable-versionhttps://www.vicarius.io/vsociety/posts/cve-2025-55188-mitigate-7-zip-vulnerabilityhttps://youtu.be/sWT6M1cfnwMhttp://www.openwall.com/lists/oss-security/2025/08/09/1http://www.openwall.com/lists/oss-security/2025/08/10/1http://www.openwall.com/lists/oss-security/2025/08/13/1