CVE-2023-31102

What it actually does

CVE-2023-31102 is a memory-corruption flaw in 7-Zip's PPMd decompression code, specifically an integer underflow leading to an invalid read while processing a crafted 7Z archive. Successful exploitation requires a vulnerable 7-Zip component to parse attacker-controlled archive content, typically through a user opening/extracting an archive or an automated service scanning, indexing, unpacking, or validating uploaded archives. Because the parser operates in the context of the calling process, impact can include process crash, information disclosure, or potentially arbitrary code execution with the privileges of the user or service running 7-Zip.

Why it matters to the business

Organizations that process untrusted archives can face workstation compromise, compromise of file-processing services, malware execution, data exposure, and disruption of archive-processing workflows. The high CVSS score and high EPSS probability indicate meaningful real-world risk even though this issue is not currently listed in CISA KEV and no ransomware use is indicated. Exposure is most concerning where 7-Zip is used automatically in mail gateways, web upload handlers, malware sandboxes, backup tools, document-processing pipelines, CI systems, or helpdesk workflows that unpack external files.

How an attack unfolds

An attacker creates a malicious 7Z archive designed to trigger the integer underflow in the vulnerable PPMd decoder. The attacker then delivers the archive through a phishing email, shared file, support ticket attachment, web upload, repository artifact, or any path where a vulnerable system will inspect or extract it. When 7-Zip before the fixed version parses the archive, the malformed PPMd data causes an invalid memory read. Depending on platform, compiler hardening, runtime protections, and process context, this may result in a crash or may be developed into code execution. If code execution is achieved, the attacker gains the privileges of the user or service account that processed the archive and can then stage malware, access files available to that context, steal credentials, or pivot to other systems.

How to fix it

Upgrade 7-Zip and any packaged or embedded 7-Zip/p7zip components to a fixed release. Upstream 7-Zip is fixed in version 23.00 and later. For Debian 13 packages reflected in the provided advisory data, update to the distribution-fixed package version 6.7.7-1 or later where applicable. Also update applications that bundle their own copy of 7-Zip libraries or binaries, because operating-system package updates may not remediate embedded copies. Where immediate patching is not possible, reduce exposure by blocking or quarantining untrusted 7Z archives, disabling automated extraction of externally supplied archives, running archive processing in a sandbox or container with no sensitive credentials, enforcing least privilege for file-processing services, and applying endpoint exploit mitigations such as ASLR, DEP/NX, and application control.

How to confirm the fix worked

Confirm installed versions of 7-Zip, p7zip, and distribution packages are at or above the fixed release. On Debian-based systems, use package inventory commands such as `dpkg -l | grep -Ei '7zip|p7zip|7z'` and verify the installed package version is 6.7.7-1 or later where that package/version applies. Also search for standalone binaries using commands such as `which 7z 7za 7zr` and `find / -type f \( -name 7z -o -name 7za -o -name 7zr \) 2>/dev/null`, then check their versions with `7z | head` or the package manager. Validate that security tools, mail gateways, upload handlers, CI jobs, and document-processing applications do not bundle vulnerable copies. For exposure testing, submit benign 7Z archives through file-processing workflows and confirm only updated/sandboxed components handle them; do not use weaponized proof-of-concept archives in production.

Typical attack path

1. Identify a target workflow or user likely to open, scan, or extract 7Z archives.
2. Craft a malformed 7Z archive that exercises the vulnerable PPMd decompression path.
3. Deliver the archive through email, file sharing, web upload, support portal, source repository, or another file-ingestion channel.
4. Wait for a user, endpoint tool, or automated backend process to invoke a vulnerable 7-Zip parser on the archive.
5. Trigger memory corruption during archive parsing, causing a crash or possible code execution in the 7-Zip process context.
6. If execution is achieved, run payloads with the privileges of the affected user or service.
7. Perform follow-on actions such as persistence, credential access, file theft, lateral movement, or disruption.

How to detect it

To determine whether exploitation may already have occurred, review endpoint, server, and application logs for archive-processing crashes or abnormal process behavior around the time 7Z files were received or processed. Relevant sources include EDR telemetry, Linux syslog/journal logs, kernel crash messages, application logs for upload or mail-processing services, mail gateway attachment logs, web server upload logs, file integrity monitoring, and shell/process execution logs such as auditd. Look for segmentation faults or abnormal exits involving `7z`, `7za`, `7zr`, `p7zip`, or applications that invoke 7-Zip. Correlate crashes with recently received `.7z` files, especially from external senders or unauthenticated uploads. Investigate any child processes spawned by archive tools, such as shells, scripting runtimes, download utilities, or network tools, because archive extraction utilities normally should not launch these. Also examine temporary extraction directories, upload staging paths, mail quarantine areas, and user download folders for suspicious 7Z archives created shortly before a crash or follow-on execution. Because there are no universal malicious file hashes or network indicators for this vulnerability, detection should focus on behavioral evidence: vulnerable parser invocation on untrusted archives, crashes in the 7-Zip process, and unexpected post-extraction process execution or network activity.

• 7z
• 7za
• 7zr
• p7zip
• 7zFM.exe
• 7zG.exe
• 7z.exe
• 7za.exe
• 7zr.exe
• segfault at
• Segmentation fault
• kernel: 7z[
• kernel: 7za[
• kernel: 7zr[
• audit: ANOM_ABEND
• comm="7z"
• comm="7za"
• comm="7zr"
• /usr/bin/7z
• /usr/bin/7za
• /usr/bin/7zr
• /usr/lib/p7zip/7z
• /usr/lib/p7zip/7za
• /usr/lib/p7zip/7zr
• .7z

What your security team should do

• Prioritize patching systems and services that automatically process untrusted archives, including mail gateways, upload services, sandboxes, file indexing systems, CI/CD runners, and support-ticket attachment processors.
• Upgrade upstream 7-Zip to 23.00 or later and Debian 13 affected packages to 6.7.7-1 or later where applicable.
• Inventory embedded or bundled 7-Zip binaries in third-party applications and internal tooling; remediate these separately from OS package updates.
• Temporarily block, quarantine, or detonate externally sourced 7Z files until vulnerable processing paths are patched.
• Run archive extraction under low-privilege accounts in isolated sandboxes or containers with restricted filesystem and network access.
• Monitor for crashes of 7z, 7za, 7zr, or applications invoking 7-Zip shortly after handling external archives.
• Hunt for suspicious child processes spawned by archive-processing services or desktop archive tools, especially shells, script interpreters, download utilities, or credential-access tooling.
• Correlate suspicious archive arrivals with endpoint crashes, EDR alerts, new files, outbound connections, or anomalous process trees.
• Educate users and helpdesk teams to treat unexpected compressed archives as suspicious, especially password-protected or unsolicited 7Z attachments.