Product by 7-Zip
7-Zip p7zip
22 known vulnerabilities in 7-Zip p7zip (7-Zip), 1 of them actively exploited (CISA KEV).
Key figures
22
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder In CISA KEValso in 13 other products | 8.1 | |
| High | CVE-2025-11001 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability | 7.0 | |
| High | CVE-2023-31102 | 7-Zip: Integer Underflow | 7.8 | |
| High | CVE-2023-40481 | 7-Zip SquashFS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2016-9296 | 7-Zip p7zip: NULL Pointer Dereference | 7.5 | |
| High | CVE-2017-17969 | 7-Zip: Heap-Based Buffer Overflow | 7.8 | |
| High | CVE-2026-48095 | Mcmilk 7-Zip: Out-of-bounds Write | 8.8 | |
| High | CVE-2026-48092 | 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) | 4.3 | |
| High | CVE-2018-5996 | 7-Zip: Memory Corruption | 7.8 | |
| High | CVE-2026-48111 | GHSL-2026-121 7-Zip UEFI DEPEX OOB Read | 4.3 | |
| High | CVE-2026-48103 | GHSL-2026-119 7-Zip WIM SecurityId OOB read | 4.3 | |
| Medium | CVE-2024-11612 | 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability | 6.5 | |
| High | CVE-2026-14266 | 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability | 7.0 | |
| High | CVE-2025-53817 | GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream | 7.5 | |
| High | CVE-2025-11002 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability | 7.0 | |
| Not rated | CVE-2015-1038 | 7-Zip p7zip: security vulnerability | — | |
| Low | CVE-2025-55188 | 7-Zip: Link Following | 3.6 | |
| Medium | CVE-2026-48101 | GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure | 6.5 | |
| Medium | CVE-2026-48112 | GHSL-2026-122 7-Zip Ar SYMDEF OOB Read | 6.5 | |
| High | CVE-2022-47069 | 7-Zip p7zip: Buffer Overflow | 7.8 | |
| Medium | CVE-2026-48104 | GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read | 4.2 | |
| Medium | CVE-2026-48102 | GHSL-2026-118: 7-Zip UDF Field OOB Read | 3.1 |
News
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emergesthehackernews,
- Node2Shell puts Microsoft and Node.js on Brotli patch dutycsoonline,
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawthehackernews,
- Node2Shell CVEsfortinet-psirt,
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Softwarethehackernews,
- Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Datathehackernews,