Description
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
kagancapar/CVE-2022-29072 ★ 670 · Apr 15, 2022
7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.
-
sentinelblue/CVE-2022-29072 ★ 8 · Apr 18, 2022
** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfigura…
-
tiktb8/CVE-2022-29072 ★ 6 · Apr 18, 2022
Powershell to mitigate CVE-2022-29072
-
Phantomiman/7-Zip.chm-Mitigation ★ 3 · Dec 20, 2022
7-Zip CVE-2022-29072 Mitigation - CHM file - This script detects if the .chm file exists and removes it.
-
rasan2001/CVE-2022-29072 ★ 0 · May 10, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- 7PAA023732 System 800xA affected by 3rd party component vulnerabilities ABB PSIRT · May 22, 2026
- WID-SEC-2024-1393 Rückruf: 7-Zip: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode BSI CERT-Bund (WID) · Jun 17, 2024