7-Zip
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 2
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 09/18/2026, 7-Zip recorded 2 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, 7-Zip had the most security vulnerabilities in the 7-Zip ecosystem, with 2 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-142667-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published07/29/2026 | SeverityHigh |
CVE-2026-580527-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published06/28/2026 | SeverityMedium |
CVE-2026-48112GHSL-2026-122 7-Zip Ar SYMDEF OOB Read | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityMedium |
CVE-2026-48111GHSL-2026-121 7-Zip UEFI DEPEX OOB Read | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityMedium |
CVE-2026-48104GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityMedium |
CVE-2026-48103GHSL-2026-119 7-Zip WIM SecurityId OOB read | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityMedium |
CVE-2026-48102GHSL-2026-118: 7-Zip UDF Field OOB Read | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityLow |
CVE-2026-48101GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityMedium |
CVE-2026-48095GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityHigh |
CVE-2026-480927-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published06/05/2026 | SeverityMedium |
CVE-2025-110027-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published01/23/2026 | SeverityHigh |
CVE-2025-110017-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published11/19/2025 | SeverityHigh |
CVE-2025-55188 | Exploitation statusNot known exploited | FixYes | Affected product7-Zip | Published08/08/2025 | SeverityLow |
CVE-2025-53817GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published07/17/2025 | SeverityMedium |
CVE-2025-53816GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published07/17/2025 | SeverityMedium |
CVE-2022-47112 | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published04/19/2025 | SeverityLow |
CVE-2022-47111 | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published04/19/2025 | SeverityLow |
CVE-2025-04117-Zip Mark-of-the-Web Bypass Vulnerability | Exploitation statusKEV | FixNot confirmed | Affected product7-Zip | Published01/25/2025 | SeverityHigh |
CVE-2024-114777-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability | Exploitation statusPublic exploit | FixNot confirmed | Affected product7-Zip | Published11/22/2024 | SeverityHigh |
CVE-2024-116127-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published11/22/2024 | SeverityMedium |
CVE-2023-404817-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Affected product7-Zip | Published05/03/2024 | SeverityHigh |
CVE-2023-31102 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/03/2023 | SeverityHigh |
CVE-2022-47069 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published08/22/2023 | SeverityUnknown |
CVE-2022-29072 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/15/2022 | SeverityUnknown |
CVE-2018-10115 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/02/2018 | SeverityUnknown |
CVE-2018-10172 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/16/2018 | SeverityUnknown |
CVE-2018-5996 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/31/2018 | SeverityUnknown |
CVE-2017-17969 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/30/2018 | SeverityUnknown |
CVE-2016-7804 | Exploitation statusNot confirmed | FixNot confirmed | Affected product7 Zip for Windows | Published05/22/2017 | SeverityUnknown |
CVE-2016-2334 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/13/2016 | SeverityUnknown |
CVE-2016-9296 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/12/2016 | SeverityUnknown |
CVE-2016-2335 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/07/2016 | SeverityUnknown |
CVE-2015-1038 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/21/2015 | SeverityUnknown |
CVE-2008-6536 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/30/2009 | SeverityUnknown |
CVE-2007-4725 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/05/2007 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
