7Z
Product
7-Zip
On CISA KEVExploited in the wild
33
CVEs
1
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 21Medium 6Low 4
Watch
Add 7-Zip to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0411 In wildKEV | 7.0 | Jan 25 | 7-Zip Mark-of-the-Web Bypass Vulnerability Affected: 24.08 (x64) |
| CVE-2026-48095 | 8.8 | Jun 5 | GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation Affected: before 26.01 |
| CVE-2018-10172 | 8.8 | Apr 16 | 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's… Affected: through 18.01 |
| CVE-2016-2335 | 8.8 | Jun 7 | The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or… Affected: 9.20; 15.05 |
| CVE-2026-48092 | 8.1 | Jun 5 | 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) Affected: 9.34 before 26.01 |
| CVE-2026-14266 | 7.8 | Jul 29 | 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability Affected: 26.01 |
| CVE-2025-11002 | 7.8 | Jan 23 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability Affected: 24.09 |
| CVE-2025-11001 | 7.8 | Nov 19 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability Affected: 24.09 |
| CVE-2024-11477 | 7.8 | Nov 22 | 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability Affected: before 24.07 |
| CVE-2023-40481 | 7.8 | May 3 | 7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability Affected: 22.01 |
| CVE-2023-31102 | 7.8 | Nov 3 | Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive Affected: before 22.01 |
| CVE-2022-29072 | 7.8 | Apr 15 | 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area Affected: through 21.07 |
| CVE-2018-10115 | 7.8 | May 2 | Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service… Affected: through 18.03 |
| CVE-2018-5996 | 7.8 | Jan 31 | Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows… Affected: before 18.00 |
| CVE-2017-17969 | 7.8 | Jan 30 | Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of service (out-of-bounds… Affected: before 18.00 |
| CVE-2016-7804 | 7.8 | May 22 | Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory Affected: through 16.02 |
| CVE-2016-2334 | 7.8 | Dec 13 | Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted… Affected: through 15.14 |
| CVE-2025-53817 | 7.5 | Jul 17 | 7-Zip is a file archiver with a high compression ratio Affected: before 25.00 |
| CVE-2025-53816 | 7.5 | Jul 17 | 7-Zip is a file archiver with a high compression ratio Affected: before 25.00 |
| CVE-2026-48111 | 7.1 | Jun 5 | GHSL-2026-121 7-Zip UEFI DEPEX OOB Read Affected: 9.21 before 26.01 |
| CVE-2026-48103 | 7.1 | Jun 5 | GHSL-2026-119 7-Zip WIM SecurityId OOB read Affected: 9.34 before 26.01 |
Showing 21