ZeroDay Findings
Sign inSign up

Findings

CVE-2025-0411

7-Zip Mark of the Web Bypass Vulnerability

Published Jan 24, 2025 · updated Jun 17, 2026 · netapp active iq unified manager

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 24, 2025 · Catalog

    Detected

    7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a c

  2. Feb 6, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Feb 27, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a c

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Feb 27, 2025

Affected

  • cpe 7-zip/7-zipversion unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • vendor 7-Zip 7-Zipversion unspecified

Sources

  • CISA KEVCVE-2025-0411

    7-Zip contains a protection mechanism failure vulnerability that allows remote attackers to bypass the Mark-of-the-Web security feature to execute arbitrary code in the context of the current user.

    cisa.gov
  • CVE.orgCVE-2025-0411

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-0411

    30-day exploitation probability 67.1%

    first.org
  • NIST NVDCVE-2025-0411

    7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page

    nvd.nist.gov

References