Approved changes feed: RSS · Atom
cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | 7 Zip (f2c7301d-8512-5d38-84e4-b3faed385a4c) |
|---|---|
| Product | 7 Zip (6f30b4d5-0085-5a75-b16c-95b457d665e4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:gitee/han_jin_fei/p7zip |
purl2cpe | 2026-06-01 10:15:10.354106 |
pkg:github/freayd/p7zip |
purl2cpe | 2026-06-01 10:15:10.354111 |
pkg:github/jbdemonte/p7zip |
purl2cpe | 2026-06-01 10:15:10.354115 |
pkg:github/jinfeihan57/p7zip |
purl2cpe | 2026-06-01 10:15:10.354118 |
pkg:github/mcmilk/7-zip |
purl2cpe | 2026-06-01 10:15:10.354122 |
pkg:sourceforge/sevenzip |
purl2cpe | 2026-06-01 10:15:10.354126 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14266 |
vulnerable | 2026-09-16 04:33:12.249905 |
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability
HIGH (7)
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.
Published: 2026-07-29T17:17:13.649Z
Updated: 2026-07-30T03:55:31.679Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-58052 |
vulnerable | 2026-07-29 01:03:16.598952 |
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
LOW (3.3)
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named '::$DATA' overwrites the extracted file's default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.
Published: 2026-06-28T01:32:54.971Z
Updated: 2026-07-14T20:48:24.263Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55188 |
vulnerable | 2026-06-08 07:33:14.337494 |
Details available
LOW (3.6)
7-Zip before 25.01 does not always properly handle symbolic links during extraction.
Published: 2025-08-08T00:00:00.000Z
Updated: 2025-11-04T22:06:47.049Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53817 |
vulnerable | 2026-06-08 07:31:15.648537 |
GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream
7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue.
Published: 2025-07-17T18:12:24.553Z
Updated: 2025-11-04T21:12:38.546Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53816 |
vulnerable | 2026-06-08 07:31:15.647952 |
GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder
7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.
Published: 2025-07-17T18:09:58.480Z
Updated: 2026-05-11T16:53:20.506Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11002 |
vulnerable | 2026-06-08 07:02:27.906803 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11001 |
vulnerable | 2026-06-08 07:02:27.901948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0411 |
vulnerable | 2026-06-08 07:02:24.538638 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11612 |
vulnerable | 2026-06-08 06:23:49.986057 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11477 |
vulnerable | 2026-06-08 06:23:49.696194 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-52169 |
vulnerable | 2026-06-08 06:17:54.384524 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40481 |
vulnerable | 2026-06-08 06:11:03.323476 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-31102 |
vulnerable | 2026-06-08 06:04:41.865124 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47112 |
vulnerable | 2026-06-08 05:50:39.855192 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47111 |
vulnerable | 2026-06-08 05:50:39.853686 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29072 |
vulnerable | 2026-06-08 05:42:46.418412 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-5996 |
vulnerable | 2026-06-08 05:11:53.201269 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10115 |
vulnerable | 2026-06-08 05:10:26.354387 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-17969 |
vulnerable | 2026-06-08 05:09:10.130451 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-2334 |
vulnerable | 2026-06-08 05:07:34.149445 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-4725 |
vulnerable | 2026-06-08 04:49:57.057202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.