CVE detail
CVE-2025-0411
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 24.9 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
11 source links · newest first
- Week in review: Exploited 7-Zip 0-day flaw, crypto-stealing malware found on App Store, Google PlayHelp Net Security
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411) CVE-2025-0411, a Mark-of-the-Web bypass vulnerability in the open-source archiver tool 7-Zip that was fixed in November 2024, has been exploited in zero-day attacks to deliver malware to Ukrainian entities, Trend Micro researchers have revealed. Crypto-stealing iOS, Android malware found on App Store, Google Play A number of iOS and Android apps on Apple’s … More →
newswww.helpnetsecurity.comFeb 9, 2025, 9:00 AM - U.S. CISA adds Microsoft Outlook, Sophos XG Firewall, and other flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Outlook, Sophos XG Firewall, and other flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The vulnerability CVE-2024-21413 (CVSS score of 9.8) is a Remote Code Execution flaw in Microsoft Outlook. […]
newssecurityaffairs.comFeb 6, 2025, 10:36 PM Russian threat groups have been observed exploiting a zero-day vulnerability in 7-Zip against Ukrainian entities.
newswww.securityweek.comFeb 5, 2025, 12:02 PMCVE-2025-0411, a Mark-of-the-Web bypass vulnerability in the open-source archiver tool 7-Zip that was fixed in November 2024, has been exploited in zero-day attacks to deliver malware to Ukrainian entities, Trend Micro researchers have revealed. The 7-Zip vulnerability (CVE-2025-0411) Mark-of-the-Web (MotW) is a zone identifier used by the Windows operating system to flag files downloaded from the internet as potentially harmful. “CVE-2025-0411 allows threat actors to bypass Windows MoTW protections by double archiving contents using 7-Zip. … More →
newswww.helpnetsecurity.comFeb 4, 2025, 1:02 PMNo excerpt available.
Mitigationwww.cisa.govJan 25, 2025, 5:15 AMNo excerpt available.
Exploitwww.vicarius.ioJan 25, 2025, 5:15 AMNo excerpt available.
Exploitwww.vicarius.ioJan 25, 2025, 5:15 AM- https://security.netapp.com/advisory/ntap-20250207-0005/security.netapp.com
No excerpt available.
Vendor Advisorysecurity.netapp.comJan 25, 2025, 5:15 AM - http://www.openwall.com/lists/oss-security/2025/01/24/6www.openwall.com
No excerpt available.
Exploitwww.openwall.comJan 25, 2025, 5:15 AM - https://www.zerodayinitiative.com/advisories/ZDI-25-045/www.zerodayinitiative.com
No excerpt available.
Exploitwww.zerodayinitiative.comJan 25, 2025, 5:15 AM - A 7-Zip bug allows to bypass the Mark of the Web (MotW) featureSecurity Affairs
A vulnerability in the 7-Zip file software allows attackers to bypass the Mark of the Web (MotW) Windows security feature. Attackers can exploit a vulnerability, tracked as CVE-2025-0411, in the free, open-source file archiver software 7-Zip to bypass the Mark of the Web (MotW) Windows security feature. Mark of the Web (MotW) is a security […]
newssecurityaffairs.comJan 22, 2025, 8:15 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-58052CVSS 4.8 · Medium
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier…
- CVE-2022-21283CVSS 5.3 · Medium
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 1…
- CVE-2021-35556CVSS 5.3 · Medium
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.…
- CVE-2023-31102CVSS 7.8 · High
Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.
- CVE-2026-66391CVSS 6.5 · Medium
Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through…
- CVE-2026-48037CVSS 6.3 · Medium
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silent…