ZDI-CAN-18588: ZDI-23-1165: 7-Zip 7Z File Parsing Integer Underflow Remote Code Execution Vulnerability
Published Aug 23, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Affected Software
1 affected component
7-Zip 7-Zip
Event History
Aug 23, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Feb 27, 2025
Advisory Published
via ZDI·05:06 AM
Frequently Asked Questions
1
What is ZDI-CAN-18588?
ZDI-CAN-18588 is a vulnerability in 7-Zip that allows remote attackers to execute arbitrary code.
2
How does ZDI-CAN-18588 work?
ZDI-CAN-18588 exploits a parsing flaw in 7-Zip's handling of 7Z files, which allows for remote code execution.
3
Is user interaction required to exploit ZDI-CAN-18588?
Yes, user interaction is required. The target must visit a malicious page or open a malicious file.
4
What is the severity of ZDI-CAN-18588?
ZDI-CAN-18588 has a severity rating of 7.8 (High).
5
How can I fix ZDI-CAN-18588?
There is currently no patch or update available for ZDI-CAN-18588. It is recommended to take caution when opening 7Z files from untrusted sources.