CVE-2025-0411
📋 TL;DR
This vulnerability allows attackers to bypass Windows' Mark-of-the-Web security feature when extracting files with 7-Zip. Attackers can craft malicious archives that, when extracted, don't inherit the security warning, potentially leading to arbitrary code execution. Users of vulnerable 7-Zip versions on Windows systems are affected.
💻 Affected Systems
- 7-Zip
📦 What is this software?
7 Zip by 7 Zip
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with user privileges leading to full system compromise, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware execution through social engineering where users download and extract malicious archives from untrusted sources, leading to system infection.
If Mitigated
Files remain flagged with MOTW warnings, users receive security prompts, and malicious code execution is prevented through proper security controls.
🎯 Exploit Status
Requires user interaction (opening malicious archive) and crafting of specific archive files. No public exploit code has been released as of current information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.07 and later
Vendor Advisory: https://www.7-zip.org/history.txt
Restart Required: No
Instructions:
1. Download 7-Zip 24.07 or later from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify installation by checking version in About dialog.
🔧 Temporary Workarounds
Disable archive extraction from untrusted sources
windowsConfigure Windows to block archive execution from internet zones or implement application control policies.
Use alternative archive software
allTemporarily use Windows built-in extraction or other archive tools until 7-Zip is patched.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unknown extracted files
- Educate users to avoid extracting archives from untrusted sources and to verify file origins
🔍 How to Verify
Check if Vulnerable:
Open 7-Zip, go to Help > About, check if version is earlier than 24.07.Check Version:
"C:\Program Files\7-Zip\7z.exe" --versionVerify Fix Applied:
After updating, verify version is 24.07 or later in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Windows Defender/Security logs showing MOTW bypass attempts
- 7-Zip process spawning unexpected child processes
Network Indicators:
- Downloads of archive files from suspicious sources followed by immediate extraction
SIEM Query:
Process Creation where (Image contains '7z' OR ParentImage contains '7z') AND CommandLine contains '.exe'🔗 References
- https://www.zerodayinitiative.com/advisories/ZDI-25-045/
- http://www.openwall.com/lists/oss-security/2025/01/24/6
- https://security.netapp.com/advisory/ntap-20250207-0005/
- https://www.vicarius.io/vsociety/posts/cve-2025-0411-7-zip-mitigation-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-0411-detection-7-zip-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0411
