7-Zip 7-Zip vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20255
3. 20264

Known exploitedNewest addition to KEV first

• CVE-2025-0411

  7-Zip Mark-of-the-Web Bypass Vulnerability

  7-Zip · 7-Zip

  ExploitedHigh7.0

Newest CVEs

• CVE-2026-104086

  7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table

  7-Zip · 7-Zip

  Medium6.8
• CVE-2026-14266

  7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

  7-Zip · 7-Zip

  High7.0
• CVE-2026-58052

  7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision

  7-Zip · 7-Zip

  Medium4.8
• CVE-2025-11002

  7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

  7-Zip · 7-Zip

  High7.0
• CVE-2025-11001

  7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

  7-Zip · 7-Zip

  High7.0
• CVE-2025-55188

  7-Zip before 25.01 does not always properly handle symbolic links during extraction.

  7-Zip · 7-Zip

  Low3.6
• CVE-2022-47112

  7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected.

  7-Zip · 7-Zip

  Low2.5
• CVE-2022-47111

  7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected.

  7-Zip · 7-Zip

  Low2.5
• CVE-2025-0411

  7-Zip Mark-of-the-Web Bypass Vulnerability

  7-Zip · 7-Zip

  ExploitedHigh7.0
• CVE-2024-11477

  7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

  7-Zip · 7-Zip

  High7.8