CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability

High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2025-02-06. EPSS: 67.1% chance of exploitation in the next 30 days.

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

Affected products

• 7-Zip 7-Zip: before 24.09 (fixed in 24.09)
• Netapp Active Iq Unified Manager: affected versions not specified

Published 2025-01-25. Last modified 2026-06-17.