Critical Patches Released for 7-Zip: Prevent Denial of Service and Remote Code Execution Vulnerabilities

Summary

Recent advisories from GHSL have highlighted critical vulnerabilities in the popular file archiver 7-Zip, affecting versions prior to 25.0.0. These vulnerabilities include memory corruption and denial of service risks due to improper handling of heap buffers and null pointers. The most severe issue, CVE-2025-11001, allows for remote code execution by exploiting symbolic link handling in ZIP files. Users are urged to update their software immediately to mitigate these risks.

What Happened

GHSL reported several vulnerabilities affecting 7-Zip versions before 25.0.0. Among them, CVE-2025-53816 and CVE-2025-53817 both lead to denial of service but through different mechanisms. The former involves a heap buffer overflow in the RAR5 handler, while the latter is due to a null pointer dereference in the Compound Document handler.

In addition, CVE-2025-55188 addresses improper handling of symbolic links during extraction, posing a low risk. However, CVE-2025-11001 presents a high-severity threat by allowing remote code execution through directory traversal vulnerabilities in ZIP file parsing.

Technical Details

CVE-2025-53816: Heap Buffer Overflow

The vulnerability arises from a miscalculation when zeroes are written outside the allocated heap buffer. The issue occurs due to an incorrect calculation of rem in the function My_ZeroMemory(_window + _winPos, (size_t)rem);. This allows attackers to overwrite memory beyond the intended bounds.

CVE-2025-53817: Null Pointer Dereference

This vulnerability is triggered when extracting from Compound Documents. The issue occurs due to an unsigned integer overflow in (item.Size + clusterSize - 1) >> bsLog, which results in numClusters64 becoming zero. Consequently, the vector call ClearAndReserve fails to allocate memory, leading to a null pointer dereference.

CVE-2025-55188: Symbolic Link Handling

7-Zip versions before 25.01 do not properly handle symbolic links during extraction, posing a low risk of denial of service but no direct code execution threat.

CVE-2025-11001: Remote Code Execution

The most critical vulnerability allows attackers to execute arbitrary code by exploiting directory traversal in ZIP file parsing. This is achieved through crafted data that manipulates the handling of symbolic links, enabling an attacker to traverse directories and execute code with elevated privileges.

Affected Products and Fixed Versions

Exploitation Status

CVE-2025-53816 and CVE-2025-53817 have been exploited in proof-of-concept scenarios, leading to denial of service. CVE-2025-11001 is particularly concerning due to its potential for remote code execution.

Indicators of Compromise

No specific indicators of compromise (IOCs) are provided in the advisories. However, users should monitor for unusual activity related to 7-Zip operations and ensure their systems are updated promptly.

Detection Opportunities

Organizations can detect exploitation attempts by monitoring for abnormal memory access patterns or null pointer dereferences during file extraction processes. Implementing network-based anomaly detection could also help identify potential exploitation of CVE-2025-11001.

Timeline

• April 24, 2025: Vulnerabilities reported privately.
• April 29, 2025: Reports acknowledged by the vendor.
• July 18, 2025: Public disclosure and advisories issued.

Why This Matters for Defenders

The vulnerabilities in 7-Zip highlight the importance of timely software updates to mitigate risks associated with memory corruption and remote code execution. Organizations relying on 7-Zip should prioritize patching these issues to prevent potential exploitation.

What Remains Unclear

While the technical details of the vulnerabilities are well-documented, specific attack vectors or real-world exploitation instances remain unconfirmed. Further information may emerge as more organizations assess their exposure.

Defender Guidance

1. Update 7-Zip: Ensure all installations are updated to version 25.0.0 or later.
2. Monitor Systems: Implement monitoring for unusual file extraction activities and memory access patterns.
3. Network Anomalies: Use network-based anomaly detection tools to identify potential exploitation attempts related to CVE-2025-11001.
4. Review Security Policies: Reassess security policies regarding the use of third-party software like 7-Zip in sensitive environments.

By following these steps, defenders can significantly reduce their risk exposure and protect against potential exploits targeting these vulnerabilities.