CVE-2025-0411

What it actually does

The flaw is in 7-Zip archive extraction handling: when an archive downloaded from the internet has Mark-of-the-Web metadata, vulnerable 7-Zip versions can extract contained files without propagating that metadata to the extracted files. On Windows, this removes the signal used by SmartScreen, Office Protected View, Attachment Execution Services, and other trust-boundary checks to treat files as internet-originated. The result is a security-control bypass that can enable arbitrary code execution in the context of the current user if the user opens or launches a malicious extracted payload.

Why it matters to the business

This vulnerability weakens a common endpoint protection boundary for downloaded files and can turn a normal-looking archive into a delivery vehicle for malware, credential theft tools, or initial access payloads. Because it is listed in CISA KEV, has active in-the-wild exploitation, and the KEV remediation deadline of 2025-02-27 has passed, unpatched systems should be treated as urgent remediation targets. Operational risk is highest for workstations and developer/admin systems where users download, receive, and extract archives from email, browsers, collaboration platforms, or code-sharing sites.

How an attack unfolds

An attacker hosts or sends a crafted archive through email, messaging, a download site, or a malicious web page. The archive is marked by Windows as internet-originated, but when the victim extracts it with a vulnerable 7-Zip version, the extracted contents do not retain the Mark-of-the-Web metadata. The attacker places a lure file, executable, script, shortcut, document, or other payload inside the archive. Because the extracted file lacks the internet-origin marker, Windows and applications may not show the expected warnings or may apply fewer restrictions. If the user opens the extracted payload, attacker-controlled code runs with the victim user's privileges, allowing follow-on actions such as persistence, credential access, command-and-control, lateral movement attempts, or deployment of additional malware.

How to fix it

Upgrade affected 7-Zip/p7zip packages to fixed versions or later. For Debian 13, p7zip is fixed in 16.02+transitional.1 and 7zip is fixed in 24.09+dfsg-1. For Red Hat devtools:2021 go-toolset-1.15-golang packages listed as affected, update to 0:1.15.14-2.el7_9 or later where applicable. For Windows deployments of 7-Zip, deploy 7-Zip 24.09 or later from a trusted source and remove older parallel installations. If immediate patching is not possible, mitigate by blocking execution of files from user-writable extraction locations, enforcing application control, disabling or restricting script interpreters for non-administrative users, quarantining archives from untrusted sources, and educating users not to open extracted executables or shortcut/script files from downloaded archives.

How to confirm the fix worked

Confirm installed versions using software inventory, package managers, or endpoint management tooling. On Debian, check package versions with commands such as `dpkg -l 7zip p7zip`; on RPM-based systems, use `rpm -q` for affected packages; on Windows, check the installed 7-Zip version from the application, file metadata, registry uninstall entries, or endpoint inventory. To validate behavior on Windows, use a benign test archive that has a Zone.Identifier alternate data stream, extract it with the installed 7-Zip version, and verify that extracted files also retain Zone.Identifier metadata. PowerShell checks such as `Get-Item -Path <file> -Stream Zone.Identifier` can confirm whether Mark-of-the-Web is present. Also verify that older copies of `7z.exe`, `7zG.exe`, and `7zFM.exe` are not present in unmanaged directories or bundled with third-party tools.

Typical attack path

1. Attacker prepares a malicious archive containing an executable, script, shortcut, document, or staged payload.
2. Attacker delivers the archive through phishing, a malicious website, file-sharing service, collaboration platform, or software/package lure.
3. The archive receives Mark-of-the-Web metadata when downloaded from the internet.
4. The victim extracts the archive using a vulnerable 7-Zip or p7zip build.
5. 7-Zip fails to propagate Mark-of-the-Web metadata to the extracted files.
6. The victim opens the extracted file without the normal internet-origin warning or restriction.
7. The payload executes in the context of the current user.
8. The attacker performs follow-on activity such as persistence, credential theft, command-and-control, data access, or movement to additional systems.

How to detect it

To determine whether this was already exploited, focus on endpoint telemetry rather than a single network indicator. Review process creation logs, EDR events, Sysmon Event ID 1, Windows Security 4688, file creation events, PowerShell logs, script interpreter activity, and browser/email download telemetry. Look for sequences where a user downloads an archive, opens it with `7z.exe`, `7zG.exe`, or `7zFM.exe`, extracts contents into Downloads, Desktop, Temp, or user-profile paths, and shortly afterward launches an executable, script, shortcut, HTML application, or document from the extracted location. Compare the original archive for a `Zone.Identifier` alternate data stream containing `ZoneId=3` or `ZoneId=4` against extracted files that lack `Zone.Identifier`; that mismatch is a strong exposure/exploitation clue. Hunt for child or near-time processes such as PowerShell, cmd, wscript, cscript, mshta, rundll32, regsvr32, or unknown executables launched from extraction paths. Also review alerts for newly created persistence, outbound command-and-control connections, credential access tools, or malware payloads following archive extraction. There are no universal malicious hashes or domains for this vulnerability because exploitation depends on attacker-supplied archives and payloads.

• 7z.exe
• 7zG.exe
• 7zFM.exe
• 7za.exe
• 7zr.exe
• :Zone.Identifier
• [ZoneTransfer]
• ZoneId=3
• ZoneId=4
• \AppData\Local\Temp\7z
• \Downloads\
• \Desktop\
• powershell.exe
• pwsh.exe
• cmd.exe
• wscript.exe
• cscript.exe
• mshta.exe
• rundll32.exe
• regsvr32.exe
• .lnk
• .hta
• .js
• .jse
• .vbs
• .vbe
• .wsf
• .ps1
• .scr

What your security team should do

• Prioritize remediation on Windows workstations, jump hosts, administrator systems, developer endpoints, and systems used to handle external files.
• Because the issue is in CISA KEV with active exploitation and the due date has passed, treat remaining vulnerable installations as overdue high-priority exposure.
• Upgrade 7-Zip to 24.09 or later and update Debian/Red Hat packages to the listed fixed versions or later.
• Search for unmanaged or portable 7-Zip binaries outside standard install paths, including copies bundled with developer tools, utilities, and software distribution packages.
• Hunt for suspicious execution chains where `7z.exe`, `7zG.exe`, or `7zFM.exe` is followed by execution of files from Downloads, Desktop, Temp, archive extraction, or user profile directories.
• Use endpoint controls to block or alert on executable, script, shortcut, and HTML application launches from user-writable archive extraction locations.
• Ensure email, web, and endpoint controls inspect archive contents and quarantine high-risk file types such as `.lnk`, `.hta`, `.js`, `.vbs`, `.wsf`, `.ps1`, `.scr`, `.exe`, `.dll`, and macro-enabled documents.
• Review detections for payload execution without Mark-of-the-Web from recently extracted archive directories.