A critical security vulnerability, identified as CVE-2024-11477, has been discovered in 7-Zip, allowing remote attackers to execute malicious code on a user’s system when extracting specially crafted archives. This flaw is caused by an integer underflow issue in the Zstandard decompression implementation, which results from improper validation of user-supplied data. If exploited, attackers can gain control of the affected process, potentially leading to serious security risks such as malware installation or system compromise.
What is 7-Zip?
7-Zip is a free, open-source file archiver software known for its high compression ratio and support for various archive formats, including ZIP, RAR, TAR, and its own 7z format. It is widely used for compressing and extracting files efficiently, making it a popular choice among Windows users. Due to its lightweight design and strong encryption features, 7-Zip is often preferred for secure file storage and sharing. However, like all software, keeping it updated is essential to avoid security vulnerabilities.
Who Is Affected?
All versions of 7-Zip before 24.07 are vulnerable to this exploit. Since 7-Zip is widely used for file compression and extraction, this flaw poses a significant risk to many users who have not updated their software recently (7-Zip Security Update Advisory (CVE-2024-11477) – ASEC).
How Does the Attack Work?
- A hacker creates a maliciously crafted archive file using the vulnerability.
- When a user extracts the archive with an outdated 7-Zip version, the flaw allows the attacker to execute code within the user’s system.
- This could lead to remote code execution (RCE), potentially allowing malware installation or unauthorized access.
Recommended Action:
To protect yourself, update 7-Zip to the latest version (24.09) immediately. The vulnerability was fixed in 7-Zip 24.07, and version 24.09 includes further security improvements.
👉 Download the latest version of 7-Zip from the official website:
https://www.7-zip.org
Additionally, always be cautious when opening compressed files, especially if they come from untrusted sources. If you haven’t updated 7-Zip in a while, it’s crucial to do so now to avoid potential exploitation.
THE END
Subscribe our Youtube channel @wiladio for more interesting video about Design, Science, Tech, and Game
More Tech articles: https://wiladio.com/category/tech/
