Cybersecurity experts have discovered two serious vulnerabilities in the 7-Zip code. These vulnerabilities could allow attackers to execute arbitrary code by processing ZIP files without the user's knowledge. Detailed descriptions of the two vulnerabilities and their fixes have been published online.
The vulnerabilities, tracked as CVE-2025-11002 and CVE-2025-11001, exploit compressed files containing links to malicious libraries. When such files are unpacked with administrator privileges, these libraries are placed in system directories and can be automatically executed.
Exploiting the vulnerabilities does not require elevated privileges: users simply need to interact with the malicious archive. This poses a particular threat to enterprise systems, as the injection of arbitrary code could lead to the complete compromise of the entire infrastructure.
7-Zip version 25.00 has fixed the discovered vulnerabilities and implemented strict path checking, blocking symbolic links beyond the unpacked directory. Experts recommend updating the program immediately and reviewing systems that automatically unpack files.
Signs of a hacker attack may include unknown libraries or executable files in protected directories and long ZIP files with suspicious paths on the system.
