Skip to content
OpenAdvisories

Vendor

7-Zip

13 known vulnerabilities.

7-Zip at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
1
Public exploit · all time
5
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202610
Sep 202600
Aug 202600
Jul 202610
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202610
Dec 202500
Nov 202510
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202500
May 202500
Apr 202520
Mar 202500
Feb 202500
Jan 202510
Dec 202400

Products

7-Zip 13
All Critical High Medium Low Exploited only Public exploit

13 results · Feed

  • High 7.8
    CVE-2026-125742

    7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder in CAB Extraction

    7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, whe…

    7-Zip 7-Zip p7zip 7zip Debian
  • Medium 5.5
    CVE-2026-104086

    7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table

    7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that …

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • High 7.0
    CVE-2026-14266 Public exploit

    7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

    7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that …

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • Low 3.3
    CVE-2026-58052

    7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision

    7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named '…

    7-Zip 7-Zip p7zip 7zip Debian
  • High 7.0
    CVE-2025-11002

    7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

    7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability bu…

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • High 7.0
    CVE-2025-11001 Public exploit EPSS 27%

    7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

    7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability bu…

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • Low 3.6
    CVE-2025-55188 Public exploit

    7-Zip before 25.01 does not always properly handle symbolic links during extraction.

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • Low 2.5
    CVE-2022-47111

    7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later …

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • Low 2.5
    CVE-2022-47112

    7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later…

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • High 7.0
    CVE-2025-0411 Exploited Public exploit EPSS 48%

    7-Zip Mark-of-the-Web Bypass Vulnerability

    7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must vi…

    7-Zip 7-Zip
    KEV Feb 6, 2025
  • High 7.8
    CVE-2024-11477 Public exploit EPSS 22%

    7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

    7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerabili…

    7-Zip 7-Zip qt6-qtwebengine qt5-qtwebengine Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2024-11612

    7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability

    7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but a…

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu
  • High 7.8
    CVE-2023-40481 EPSS 14%

    7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that th…

    7-Zip 7-Zip p7zip 7zip Debian Ubuntu