The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of SQFS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18589.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| 7 Zip | — | — | Sep 15, 2023 | Aug 23, 2023 |
| 7 Zip 7 Zip | — | Upgrade 7-Zip to the latest version | Dec 19, 2024 | May 3, 2024 |
| Debian | — | Upgrade 7zipUpgrade p7zip | May 15, 2025 | May 3, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub