Recent 7-Zip Vulnerability Exploited in Attacks

A SecurityWeek report published on 20 November 2025 details a high‑severity remote code execution vulnerability in 7-Zip, tracked as CVE-2025-11001 (CVSS 7.0) that requires user interaction to be exploited. The flaw affects how 7-Zip handles symbolic links in ZIP files, allowing an attacker to traverse directories and potentially run code in the context of a service account, according to ZDI advisories.

Google Security investigator notes and NHS England warnings indicate that threat actors are actively targeting unpatched installations in the wild, with a PoC exploit available for CVE-2025-11001. The issues were reported to 7-Zip’s developers in May and were fixed in version 25.00, which was released in July, with a related vulnerability CVE-2025-11002 also credited to GMO Flatt Security’s Ryota Shiga.

Exploitation can only occur on Windows systems and hinges on how 7-Zip converts Linux symbolic links to Windows paths, potentially allowing arbitrary file writes when the process runs with administrative privileges.