CVE-2016-2334: 7-Zip

High severity, CVSS 7.8. EPSS: 14.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.

Affected products

• 7-Zip 7-Zip: up to and including 15.14
• Fedoraproject Fedora: version 23 only; version 24 only
• Oracle Solaris: any version

Published 2016-12-13. Last modified 2026-06-17.