CVE-2016-2335

What it actually does

Out-of-bounds read in CInArchive::ReadFileItem when parsing the PartitionRef field of a Long Allocation Descriptor inside a UDF image, resulting in memory corruption that can be leveraged for denial of service or arbitrary code execution.

Why it matters to the business

Attackers can crash archive-extraction processes or obtain code execution on systems that handle untrusted UDF files, increasing risk of malware deployment and data theft on developer and operations workstations that routinely unpack archives.

How an attack unfolds

An attacker builds a UDF image containing a Long Allocation Descriptor with an out-of-range PartitionRef value, then delivers the file through email, web download, or shared storage. When a victim opens the archive with a vulnerable 7-Zip or p7zip build, the parser dereferences invalid memory, enabling control-flow hijacking or a crash.

How to fix it

Upgrade 7-Zip to a current release that contains the corrected UdfIn.cpp logic and p7zip to an equivalent patched build; disable UDF support or archive extraction from untrusted sources until patches are applied.

How to confirm the fix worked

Confirm installed 7-Zip or p7zip version is newer than the affected releases, run the application against known-good and known-malicious UDF test files, and verify that no crash or unexpected memory access occurs.

Typical attack path

1. Construct malicious UDF archive with crafted PartitionRef field
2. Host or send the archive to the target environment
3. Victim opens the file using vulnerable 7-Zip or p7zip
4. Parser triggers out-of-bounds read and memory corruption
5. Attacker payload executes or process terminates

How to detect it

Search endpoint and application logs for 7-Zip or p7zip processes that terminate unexpectedly while handling .udf, .iso, or .img files; inspect crash dumps for references to UdfIn.cpp or PartitionRef handling.

• 7z.exe
• 7za.exe
• UdfIn.cpp
• PartitionRef

What your security team should do

• Prioritize immediate upgrade of all 7-Zip and p7zip installations across the estate
• Add UDF file type to email and web-gateway block lists pending remediation
• Hunt for historical 7z.exe or 7za crashes correlated with UDF file opens in endpoint telemetry
• Review archive-handling scripts and CI pipelines for direct use of vulnerable versions