CVE-2025-0411
Description
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
Summary dbcve.org
7-Zip fails to propagate the Mark-of-the-Web (MOTW) security zone identifier when extracting files from archives. When a user opens a malicious archive downloaded from the internet (which carries the MOTW flag), the extracted files lose this protection, allowing the attacker to execute arbitrary code without the normal security warnings that MOTW would trigger.
Mitigation
Update 7-Zip to the latest version once available. Until patched, exercise extreme caution with archives from untrusted sources and consider disabling script execution capabilities on endpoints as a defense-in-depth measure.