CVE-2025-0411

HighCVSS 7.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Jan 25, 2025
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 6, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-04127.8Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to CVE-2025-04137.8Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attacker CVE-2025-04159.2A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the CVE-2025-04168.9Local privilege escalation through insecure DCOM configuration in Valmet DNA versions prior to C2023. The DCOM object Valmet DNA Engineering CVE-2025-04177.0Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of lo CVE-2025-04185.2Valmet DNA user passwords in plain text. This practice poses a security risk as attackers who gain access to local project data can read the CVE-2025-04194.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies CVE-2025-04204.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows CVE-2025-04214.7Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. T CVE-2025-04228.6An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote C CVE-2025-04235.3In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site CVE-2025-04245.1In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site sc