Live › vulnerability › CVE-2025-0411
Go to dashboard7-Zip has a flaw where files pulled from the internet lose their Mark-of-the-Web warning flag when extracted, so Windows does not warn before opening them. An attacker who gets a victim to open a crafted archive can run arbitrary code as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| 7-Zip 7-Zip | vendor | – | – |
| netapp active iq unified manager | vendor | – | – |
| 7-zip | vendor | < 24.09 | 24.09 |
Check the installed 7-Zip version under Help > About in the 7-Zip GUI or the file properties of 7z.exe.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
This page as .md · .json · in your agent: get_signal("CVE-2025-0411")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.