7-Zip RCE flaw (CVE-2025-11001) actively exploited in attacks in the wild

7-Zip’s remote code execution flaw, CVE-2025-11001, is described as actively exploited in the wild, with NHS England warning that attackers can trigger arbitrary code on affected installations. The advisory notes that a proof-of-concept exploit leverages symbolic-link handling to write files outside the intended extraction folder, potentially enabling arbitrary code execution in the context of a service account.

The vulnerability exists in the handling of symbolic links in ZIP files, and researchers Ryota Shiga (GMO Flatt Security Inc.) with takumi-san[.]ai reported it. Version 25.00, released in July 2025, addresses the flaw. The advisory also states that exploitability requires interaction with the product, and that the vulnerability can only be exploited from the context of an elevated user or machine with developer mode enabled, and only on Windows, according to NHS England.