5.5Orta

CVE-2025-53817GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream

ipavlov 7-Zip Yayım: 2025-07-17 21:12 (1 yıl önce)

Açıklama

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue.

Zayıflık türü (CWE): CWE-476

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
7-zip	7-zip	< 25.00
ipavlov	7-Zip	< 25.0.0

Kaynaklar ve yamalar

https://securitylab.github.com/advisories/GHSL-2025-059_7-Zip/ ExploitThird Party Advisory
https://www.openwall.com/lists/oss-security/2025/07/18/2 ExploitMailing List
http://www.openwall.com/lists/oss-security/2025/07/18/2

CPE eşleşmeleri (NVD) (1)

cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:* < 25.00

CVSS puanı

5.5Orta

Kaynak: GitHub_M · CVSS 4.0

Saldırı yolu: Yerel
Karmaşıklık: Düşük
Ön koşul: Yok
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Gizlilik: Yok
Bütünlük: Yok
Erişilebilirlik: Yüksek

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Tüm puanlar (3)

cna	CVSS 4.0	5.5Orta
security-advisories@github.com	CVSS 4.0	5.5Orta
nvd	CVSS 3.1	7.5Yüksek

EPSS (30 günde istismar olasılığı)

0.71%

tüm CVE'lerin %54'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2025-07-09
Yayımlandı2025-07-17 21:12
IP-DB'ye ulaştı2026-10-24 23:58
Son güncelleme2026-06-17 12:38

Numarayı veren (CNA): GitHub_M
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — 7-Zip

7.8Yüksek

CVE-2026-125742 dün

7-Zip before 26.06 Heap Out-of-Bounds Write via LZX Decoder in CAB Extraction

7-Zip 7-Zip

7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuation CAB volume declares a smaller window. Attackers can entice victims to extract crafted multi-volume CAB archives, whe…

5.5Orta

CVE-2026-104086 28 gün önce

7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table

7-Zip 7-Zip

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids field is set so that …

7.0Yüksek

CVE-2026-14266 3 ay önce

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability

7-Zip 7-Zip

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that …

3.3Düşük

CVE-2026-58052 4 ay önce

7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision

7-Zip 7-Zip

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named '…

6.5Orta

CVE-2026-48112 5 ay önce

GHSL-2026-122 7-Zip Ar SYMDEF OOB Read

mcmilk 7-Zip

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-sty…

4.3Orta

CVE-2026-48111 5 ay önce

GHSL-2026-121 7-Zip UEFI DEPEX OOB Read

mcmilk 7-Zip

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The functi…

2.2%EPSS