← Back to CVEs

CVE-2025-0411

HIGHCISA KEV

7.0

Description

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

CVE Details

CVSS v3.1 Score7.0

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

Published1/25/2025

Last Modified10/27/2025

Sourcekev

Honeypot Sightings0

CISA KEV

Vendor7-Zip

Product7-Zip

Vulnerability Name7-Zip Mark of the Web Bypass Vulnerability

KEV Date Added2025-02-06

Remediation Due Date2025-02-27

Ransomware UseUnknown

Affected Products

7-zip:7-zipnetapp:active_iq_unified_manager

Weaknesses (CWE)

CWE-693

References

https://www.zerodayinitiative.com/advisories/ZDI-25-045/(zdi-disclosures@trendmicro.com)

http://www.openwall.com/lists/oss-security/2025/01/24/6(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20250207-0005/(af854a3a-2127-422b-91ae-364da2661108)

https://www.vicarius.io/vsociety/posts/cve-2025-0411-7-zip-mitigation-vulnerability(af854a3a-2127-422b-91ae-364da2661108)

https://www.vicarius.io/vsociety/posts/cve-2025-0411-detection-7-zip-vulnerability(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0411(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.