Description
7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.
The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 7-Zip | 7-Zip | 24.06 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | 7zip | 24.07+dfsg-1 | — |
| Debian 13 | 7zip | 24.07+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | p7zip | No fix yet | — |
| Ubuntu 20.04 LTS | p7zip | No fix yet | — |
| Ubuntu 18.04 LTS | p7zip | No fix yet | — |
| Ubuntu 16.04 LTS | p7zip | No fix yet | — |
| Ubuntu 14.04 LTS | p7zip | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libqt5-qtwebengine | 5.15.19-1.1 | openSUSE-SU-2025:15531-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | qt6-qtwebengine | 6.8.2-r3 | — |
| Alpine v3.23 | qt5-qtwebengine | 5.15.17-r10 | — |
| Alpine v3.23 | qt6-qtwebengine | 6.8.2-r3 | — |
| Alpine v3.22 | qt5-qtwebengine | 5.15.17-r10 | — |
| Alpine v3.22 | qt6-qtwebengine | 6.8.2-r3 | — |
| Alpine v3.21 | qt5-qtwebengine | 5.15.17-r7 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
TheN00bBuilder/cve-2024-11477-writeup ★ 64 · Nov 29, 2024
CVE-2024-11477 7Zip Code Execution Writeup and Analysis
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- 7PAA023732 System 800xA affected by 3rd party component vulnerabilities ABB PSIRT · May 22, 2026
- WID-SEC-2024-3512 7-Zip: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Mar 31, 2026
- openSUSE-SU-2025:15531-1 libQt5Pdf5-5.15.19-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-25-184-03 Mitsubishi Electric MELSOFT Update Manager (Update B) CISA ICS & IT advisories · Feb 5, 2026