CVE-2025-0411— 7-Zip Mark-of-the-Web Bypass Vulnerability
Quick assessment
Affected
7-Zip 7-Zip
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
7-Zip是7-Zip开源的一个压缩软件。 7-Zip 24.09之前版本存在安全漏洞，该漏洞源于存在绕过漏洞，允许远程攻击者在当前用户的环境中执行任意代码。
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1204.002 · Malicious File
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-0411
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
7-Zip Mark-of-the-Web Bypass Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Vulnerability Title
7-Zip 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
7-Zip是7-Zip开源的一个压缩软件。 7-Zip 24.09之前版本存在安全漏洞，该漏洞源于存在绕过漏洞，允许远程攻击者在当前用户的环境中执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2025-0411
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | This repository contains POC scenarios as part of CVE-2025-0411 MotW bypass. | https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC | POC Details |
| 2 | This repository contains POC scenarios as part of CVE-2025-0411 MotW bypass. | https://github.com/CastroJared/7-Zip-CVE-2025-0411-POC | POC Details |
| 3 | 7-Zip Mark-of-the-Web绕过漏洞PoC(CVE-2025-0411) | https://github.com/iSee857/CVE-2025-0411-PoC | POC Details |
| 4 | None | https://github.com/ishwardeepp/CVE-2025-0411-MoTW-PoC | POC Details |
| 5 | None | https://github.com/cesarbtakeda/7-Zip-CVE-2025-0411-POC | POC Details |
| 6 | This repository contains POC scenarios as part of CVE-2025-0411 MotW bypass. | https://github.com/dpextreme/7-Zip-CVE-2025-0411-POC | POC Details |
| 7 | This repository contains POC scenarios as part of CVE-2025-0411 MotW bypass. | https://github.com/SalehAlgnay/7-Zip-CVE-2025-0411-POC | POC Details |
| 8 | CVE-2025-0411 7-Zip Mark-of-the-Web Bypass | https://github.com/betulssahin/CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass | POC Details |
| 9 | CVE-2025-0411 | https://github.com/B1ack4sh/Blackash-CVE-2025-0411 | POC Details |
| 10 | Rust Macros No Recoil Guide 🚀 Boost Aim Like a Pro in C and Python | https://github.com/RustMacrosRecoil/7-Zip-CVE-2025-0411-POC | POC Details |
| 11 | CVE-2025-0411 | https://github.com/Ashwesker/Blackash-CVE-2025-0411 | POC Details |
| 12 | CVE-2025-0411 | https://github.com/Ashwesker/Ashwesker-CVE-2025-0411 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-0411
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-0411 (1)
-
ZDI-25-045 | Zero Day Initiative x_research-advisory
IV. Related Vulnerabilities
Same product: 7-Zip
-
CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Cod -
CVE-2026-58052
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Strea -
CVE-2026-48112
GHSL-2026-122 7-Zip Ar SYMDEF OOB Read -
CVE-2026-48111
GHSL-2026-121 7-Zip UEFI DEPEX OOB Read -
CVE-2026-48104
GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap
Same vendor: 7-Zip
-
CVE-2026-14266
7-Zip XZ Decompression Heap-based Buffer Overflow Remote Cod -
CVE-2026-58052
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Strea -
CVE-2025-11002
7-Zip ZIP File Parsing Directory Traversal Remote Code Execu -
CVE-2025-11001
7-Zip ZIP File Parsing Directory Traversal Remote Code Execu -
CVE-2025-55188
7-Zip 安全漏洞
Same weakness: CWE-693
-
CVE-2026-105083
ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy By -
CVE-2025-71424
Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount -
CVE-2026-100676
stoatchat before 0.15.5 Local Filesystem Read via SVG -
CVE-2026-94251
Apache Sling Security Bundle: ContentDispositionFilter media -
CVE-2026-91796
Foxit PDF Editor/Reader importIcon NTLM Response Information
V. Comments for CVE-2025-0411
No comments yet