Cloudanix VulnDB

CVE-2024-11477

High · 7.8

CVSS

7.8

EPSS

22.4%

Published

Nov 22, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A problem in how 7-Zip opens certain compressed files could let someone take over your computer if you open a malicious file.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer underflow during Zstandard decompression allows out-of-bounds memory writes, enabling arbitrary code execution within the 7-Zip process context.

Why it matters to the business

Attackers can gain control of systems that process untrusted compressed archives, leading to malware deployment, data theft, or ransomware without user interaction beyond opening the file.

How an attack unfolds

An attacker supplies a specially crafted Zstandard-compressed archive that triggers the integer underflow on decompression; because 7-Zip is widely used to extract files received via email, downloads, or archives, the malicious payload executes in the context of the current user process.

How to fix it

Update 7-Zip to the latest stable release containing the Zstandard decompression fix; avoid opening untrusted archives until patched; consider application allow-listing for archive utilities.

How to confirm the fix worked

Confirm 7-Zip version is newer than the vulnerable release; test decompression of known-good and crafted Zstandard archives in a sandbox; review vendor release notes for the specific Zstandard fix.

Typical attack path

  1. Craft malicious Zstandard archive exploiting the underflow
  2. Deliver archive to target via email, web download, or shared storage
  3. Victim opens or extracts the archive using 7-Zip
  4. Integer underflow occurs during decompression, corrupting memory
  5. Shellcode executes, establishing attacker control

How to detect it

Search process-creation logs for 7z.exe spawning unexpected child processes; inspect archive extraction events immediately preceding suspicious process activity; review file-system changes in temporary directories after archive handling.

What your security team should do

  • Prioritize patching all 7-Zip installations within 48 hours due to high EPSS score
  • Block execution of 7z.exe from user-writable directories via application control
  • Monitor for new exploit code and add corresponding YARA or behavioral rules
  • Educate users to treat unsolicited compressed files as high-risk

The record

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 7zip 0 24.07+dfsg-1
Ubuntu:14.04:LTS p7zip 0 No fix
Ubuntu:16.04:LTS p7zip 0 No fix
Ubuntu:18.04:LTS p7zip 0 No fix
Ubuntu:20.04:LTS p7zip 0 No fix
Ubuntu:22.04:LTS 7zip 0 No fix
Ubuntu:22.04:LTS p7zip 0 No fix
Ubuntu:24.04:LTS 7zip 0 No fix
Ubuntu:24.04:LTS p7zip 0 16.02+transitional.1
Ubuntu:24.10 7zip 0 24.08+dfsg-1
Ubuntu:Pro:14.04:LTS p7zip 0 No fix
Ubuntu:Pro:16.04:LTS p7zip 0 No fix
Ubuntu:Pro:18.04:LTS p7zip 0 No fix
Ubuntu:Pro:20.04:LTS p7zip 0 No fix
openSUSE:Tumbleweed libqt5-qtwebengine 0 5.15.19-1.1

Related vulnerabilities