CVE-2024-11477: 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

Q: What is the severity of CVE-2024-11477?

CVE-2024-11477 is classified as a critical vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2024-11477?

To mitigate CVE-2024-11477, update 7-Zip to version 24.07 or later as that version includes a patch for this vulnerability.

Q: What types of systems are affected by CVE-2024-11477?

CVE-2024-11477 affects all installations of 7-Zip prior to version 24.07.

Q: What could an attacker do if CVE-2024-11477 is exploited?

If exploited, CVE-2024-11477 allows attackers to execute arbitrary code on the targeted system.

Q: Is user interaction required to exploit CVE-2024-11477?

Yes, interaction with the 7-Zip library is necessary for an attacker to exploit CVE-2024-11477.

Published Nov 20, 2024

Updated

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Affected Software

12 affected componentsFixes available

7-Zip 7-Zip<24.07

debian/7zip<24.07+dfsg-1

24.07+dfsg-1

debian/7zip<24.07+dfsg-1

24.07+dfsg-1

debian/7zip

22.01+really26.01+dfsg-0+deb12u122.01+really26.02+dfsg-0+deb12u125.01+dfsg-1~deb13u226.05+dfsg-1

debian/p7zip

16.02+really26.01+dfsg-0+deb12u116.02+really26.02+dfsg-0+deb12u116.02+transitional.1

7-Zip 7-Zip

alpine/qt5-qtwebengine<5.15.17-r7

5.15.17-r7

alpine/qt5-qtwebengine<5.15.17-r10

5.15.17-r10

alpine/qt5-qtwebengine<5.15.17-r10

5.15.17-r10

alpine/qt6-qtwebengine<6.8.2-r3

6.8.2-r3

alpine/qt6-qtwebengine<6.8.2-r3

6.8.2-r3

alpine/qt6-qtwebengine<6.8.2-r3

6.8.2-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/7zip to a version that resolves this vulnerability.
Fixed in 24.07+dfsg-1
Upgrade
Upgrade debian/7zip to a version that resolves this vulnerability.
Fixed in 22.01+really26.01+dfsg-0+deb12u1Fixed in 22.01+really26.02+dfsg-0+deb12u1Fixed in 25.01+dfsg-1~deb13u2Fixed in 26.05+dfsg-1
Upgrade
Upgrade debian/p7zip to a version that resolves this vulnerability.
Fixed in 16.02+really26.01+dfsg-0+deb12u1Fixed in 16.02+really26.02+dfsg-0+deb12u1Fixed in 16.02+transitional.1
Upgrade
Upgrade alpine/qt5-qtwebengine to a version that resolves this vulnerability.
Fixed in 5.15.17-r7
Upgrade
Upgrade alpine/qt5-qtwebengine to a version that resolves this vulnerability.
Fixed in 5.15.17-r10
Upgrade
Upgrade alpine/qt6-qtwebengine to a version that resolves this vulnerability.
Fixed in 6.8.2-r3

Event History

Nov 20, 2024

Advisory Published

via ZDI·12:00 AM

Data Sourced

via ZDI·12:00 AM

DescriptionSeverityAffected Software

Nov 22, 2024

CVE Published

via MITRE·08:22 PM

Data Sourced

via MITRE·08:22 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·09:15 PM

DescriptionSeverityAffected Software

Apr 17, 2025

Data Sourced

12:00 AM

SeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

7953464231024620823

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2024-26921

Frequently Asked Questions

What is the severity of CVE-2024-11477?

CVE-2024-11477 is classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2024-11477?

To mitigate CVE-2024-11477, update 7-Zip to version 24.07 or later as that version includes a patch for this vulnerability.

What types of systems are affected by CVE-2024-11477?

CVE-2024-11477 affects all installations of 7-Zip prior to version 24.07.

What could an attacker do if CVE-2024-11477 is exploited?

If exploited, CVE-2024-11477 allows attackers to execute arbitrary code on the targeted system.

Is user interaction required to exploit CVE-2024-11477?

Yes, interaction with the 7-Zip library is necessary for an attacker to exploit CVE-2024-11477.

CVE-2024-11477: 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-11477?

How do I fix CVE-2024-11477?

What types of systems are affected by CVE-2024-11477?

What could an attacker do if CVE-2024-11477 is exploited?

Is user interaction required to exploit CVE-2024-11477?

Company

Resources

Contact