7Z
Product
7-Zip
On CISA KEVExploited in the wild
33
CVEs
1
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 21Medium 6Low 4
Watch
Add 7-Zip to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0411 In wildKEV | 7.0 | Jan 25 | 7-Zip Mark-of-the-Web Bypass Vulnerability Affected: 24.08 (x64) |
| CVE-2026-48095 | 8.8 | Jun 5 | GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation Affected: before 26.01 |
| CVE-2018-10172 | 8.8 | Apr 16 | 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's… Affected: through 18.01 |
| CVE-2016-2335 | 8.8 | Jun 7 | The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or… Affected: 9.20; 15.05 |
| CVE-2026-48092 | 8.1 | Jun 5 | 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) Affected: 9.34 before 26.01 |
| CVE-2026-14266 | 7.8 | Jul 29 | 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability Affected: 26.01 |
| CVE-2025-11002 | 7.8 | Jan 23 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability Affected: 24.09 |
| CVE-2025-11001 | 7.8 | Nov 19 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability Affected: 24.09 |
| CVE-2024-11477 | 7.8 | Nov 22 | 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability Affected: before 24.07 |
| CVE-2023-40481 | 7.8 | May 3 | 7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability Affected: 22.01 |
| CVE-2023-31102 | 7.8 | Nov 3 | Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive Affected: before 22.01 |
| CVE-2022-29072 | 7.8 | Apr 15 | 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area Affected: through 21.07 |
| CVE-2018-10115 | 7.8 | May 2 | Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service… Affected: through 18.03 |
| CVE-2018-5996 | 7.8 | Jan 31 | Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows… Affected: before 18.00 |
| CVE-2017-17969 | 7.8 | Jan 30 | Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds… Affected: before 18.00 |
| CVE-2016-7804 | 7.8 | May 22 | Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory Affected: through 16.02 |
| CVE-2016-2334 | 7.8 | Dec 13 | Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted… Affected: through 15.14 |
| CVE-2025-53817 | 7.5 | Jul 17 | 7-Zip is a file archiver with a high compression ratio Affected: before 25.00 |
| CVE-2025-53816 | 7.5 | Jul 17 | 7-Zip is a file archiver with a high compression ratio Affected: before 25.00 |
| CVE-2026-48111 | 7.1 | Jun 5 | GHSL-2026-121 7-Zip UEFI DEPEX OOB Read Affected: 9.21 before 26.01 |
| CVE-2026-48103 | 7.1 | Jun 5 | GHSL-2026-119 7-Zip WIM SecurityId OOB read Affected: 9.34 before 26.01 |
| CVE-2026-48112 | 6.5 | Jun 5 | GHSL-2026-122 7-Zip Ar SYMDEF OOB Read Affected: 9.34 before 26.01 |
| CVE-2026-48101 | 6.5 | Jun 5 | GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure Affected: 9.21 before 26.01 |
| CVE-2024-11612 | 6.5 | Nov 22 | 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability Affected: 24.06 before 24.08 |
| CVE-2026-104086 | 5.5 | Oct 14 | 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table Affected: before 26.03 |
| CVE-2026-48102 | 4.3 | Jun 5 | GHSL-2026-118: 7-Zip UDF Field OOB Read Affected: 9.11 before 26.01 |
| CVE-2026-48104 | 4.2 | Jun 5 | GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read Affected: 9.18 before 26.01 |
| CVE-2025-55188 | 3.6 | Aug 8 | 7-Zip before 25.01 does not always properly handle symbolic links during extraction Affected: before 25.01 |
| CVE-2026-58052 | 3.3 | Jun 28 | 7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision Affected: through 26.01 |
| CVE-2022-47112 | 3.3 | Apr 19 | 7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits Affected: 22.01 |
| CVE-2022-47111 | 3.3 | Apr 19 | 7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits Affected: 22.01 |
| CVE-2008-6536 | – | Mar 30 | Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10) Affected: through 4.56; 3.13; 4.20; 4.23; 4.24; 4.25; +30 more |
| CVE-2007-4725 | – | Sep 5 | Stack consumption vulnerability in AkkyWareHOUSE 7-zip32.dll before 4.42.00.04, as derived from Igor Pavlov 7-Zip before 4.53 beta, allows user-assisted remote attackers to… Affected: through 4.42; 4.43; 4.44; 4.45; 4.46; 4.47; +5 more |
Showing 33