CVE-2023-52169

What it actually does

Out-of-bounds read in the NTFS handler allows an attacker-controlled buffer to be read past its intended length, with the extra bytes surfaced directly in extracted filenames.

Why it matters to the business

Server-side archive extraction services that accept untrusted uploads can leak limited file-system metadata or experience denial-of-service crashes, increasing operational risk and potential data exposure for any organization processing user-supplied archives.

How an attack unfolds

An attacker crafts a malicious NTFS file-system image that triggers the out-of-bounds read inside NtfsHandler.cpp, uploads it to a web service that extracts archives with an affected 7-Zip binary, and observes either the leaked filename bytes or a crash in the extraction process.

How to fix it

Upgrade 7-Zip (including 7zz) to version 24.01 or later on all systems that perform archive extraction, especially any server-side or automated processing pipelines.

How to confirm the fix worked

Confirm the installed 7-Zip binary reports version 24.01 or newer; re-test extraction of known-malicious test cases and verify that no out-of-bounds filename data appears and the process remains stable.

Typical attack path

1. Craft NTFS image containing oversized or malformed directory entries
2. Upload the image to a service that invokes 7-Zip server-side
3. Trigger extraction of the archive
4. Observe leaked filename fragments or service crash

How to detect it

Review 7-Zip process logs and extraction service logs for crashes or unusually long or malformed filenames; correlate with upload timestamps from untrusted sources.

What your security team should do

• Immediately inventory all deployments of 7-Zip and prioritize upgrade to 24.01+ on any internet-facing or multi-tenant extraction service
• Add 7-Zip version checks to CI/CD and container base-image scans
• Monitor extraction services for unexpected crashes or unusually long filenames after upgrade