7-Zip Vulnerabilities Allowing Remote Code Execution

Two critical vulnerabilities in 7-Zip’s handling of ZIP archives have emerged, enabling remote attackers to execute arbitrary code by exploiting directory traversal flaws, with both issues stemming from improper processing of symbolic links within ZIP files. According to Zero Day Initiative, the flaws are tracked as CVE-2025-11002 (ZDI-25-950, ZDI-CAN-26743) and CVE-2025-11001 (ZDI-25-949, ZDI-CAN-26753).

When a vulnerable archive is processed, 7-Zip can follow links to directories outside the extraction path, allowing an attacker to overwrite arbitrary files or place malicious payloads that can be executed by interacting services or scheduled tasks. A proof-of-concept demonstrates a symbolic link entry pointing to a path such as ../../../../windows/system32/malicious.dll, which, on extraction by a SYSTEM-account service, places the DLL in System32 and enables code execution with elevated privileges.

The vendor was alerted on 2 May 2025, and a public advisory was released with an update on 7 October 2025; users are urged to upgrade to 7-Zip 25.00 to mitigate the vulnerabilities.