Vendor
7-Zip
37 known vulnerabilities in products by 7-Zip, 2 of them actively exploited (CISA KEV).
Key figures
37
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder In CISA KEValso in 17 other products | 9.8 | |
| Critical | CVE-2025-0411 | 7-Zip Mark-of-the-Web Bypass Vulnerability In CISA KEValso in 1 other product | 7.0 | |
| High | CVE-2025-11001 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability | 7.0 | |
| High | CVE-2024-11477 | 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2023-31102 | 7-Zip: Integer Underflow | 7.8 | |
| High | CVE-2023-40481 | 7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2016-2335 | 7-Zip: Out-of-Bounds Read | 8.8 | |
| High | CVE-2016-2334 | 7-Zip: Heap-Based Buffer Overflow | 7.8 | |
| High | CVE-2016-9296 | 7-Zip p7zip: NULL Pointer Dereference | 7.5 | |
| High | CVE-2017-17969 | 7-Zip: Heap-Based Buffer Overflow | 7.8 | |
| High | CVE-2018-10115 | 7-Zip: Use of Uninitialized Memory | 7.8 | |
| High | CVE-2026-48095 | Mcmilk 7-Zip: Out-of-bounds Write | 8.8 | |
| High | CVE-2026-48092 | 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) | 4.3 | |
| High | CVE-2018-5996 | 7-Zip: Memory Corruption | 7.8 | |
| High | CVE-2026-48111 | GHSL-2026-121 7-Zip UEFI DEPEX OOB Read | 4.3 | |
| High | CVE-2026-48103 | GHSL-2026-119 7-Zip WIM SecurityId OOB read | 4.3 | |
| High | CVE-2016-7804 | Igor Pavlov 7 Zip for Windows: Privilege Escalation | 7.8 | |
| Medium | CVE-2024-11612 | 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability | 6.5 | |
| High | CVE-2026-14266 | 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability | 7.0 | |
| High | CVE-2022-29072 | 7-Zip: Privilege Escalation | 7.8 | |
| High | CVE-2025-53816 | GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder | 7.5 | |
| High | CVE-2025-53817 | GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream | 7.5 | |
| Not rated | CVE-2007-4725 | 7-Zip: Heap-Based Buffer Overflow | — | |
| High | CVE-2025-11002 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability | 7.0 | |
| Medium | CVE-2026-104086 | 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table | 5.5 |
News
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026cisco-psirt,
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emergesthehackernews,
- Node2Shell puts Microsoft and Node.js on Brotli patch dutycsoonline,
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawthehackernews,
- Node2Shell CVEsfortinet-psirt,
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Softwarethehackernews,
Products
| 7-Zip | 33 | 1 |
| 7-Zip p7zip | 6 | 1 |