CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability

What it is

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

Exploitation evidence

First exploit evidence seen: 2025-01-25 (earliest date across the sources below).

Exploited in the wild

• CISA KEV: listed since 2025-02-06. Source

Public exploit code

GitHub proof-of-concept repositories

6 public repositories from 6 accounts, first seen 2025-01-25. Most starred: dhmosfunk/7-Zip-CVE-2025-0411-POC (154 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · nomi-sec/PoC-in-GitHub.

How to fix it

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

• 7-zip 7-zip: upgrade to 24.09 or later

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://www.7-zip.org/history.txt (CISA KEV notes)
• https://www.vicarius.io/vsociety/posts/cve-2025-0411-7-zip-mitigation-vulnerability (Mitigation)
• https://www.vicarius.io/vsociety/posts/cve-2025-0411-detection-7-zip-vulnerability (Mitigation)

MITRE ATT&CK mitigations for this chain

• M1056 Pre-compromise (for T1588.001) : This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.
• M1049 Antivirus/Antimalware (for T1566.001) : Anti-virus can also automatically quarantine suspicious files.
• M1018 User Account Management (for T1566.001) : Apply user account management principles to limit permissions for accounts interacting with email attachments, ensuring that only necessary accounts have the ability to open or execute files. Restricting account privileges reduces the potential impact of malicious attachments by preventing unauthorized execution or spr
• M1047 Audit (for T1566.001) : Enable auditing and monitoring for email attachments and file transfers to detect and investigate suspicious activity. Regularly review logs for anomalies related to attachments containing potentially malicious content, as well as any attempts to execute or interact with these files. This practice helps identify spearp
• M1031 Network Intrusion Prevention (for T1566.001) : Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.
• M1054 Software Configuration (for T1566.001) : Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform simil
• M1017 User Training (for T1566.001) : Users can be trained to identify social engineering techniques and spearphishing emails.
• M1021 Restrict Web-Based Content (for T1566.001) : Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachmen
• M1042 Disable or Remove Feature or Program (for T1553.005) : Consider disabling auto-mounting of disk image files (i.e., .iso, .img, .vhd, and .vhdx). This can be achieved by modifying the Registry values related to the Windows Explorer file associations in order to disable the automatic Explorer "Mount and Burn" dialog for these file extensions. Note: this will not deactivate t
• M1038 Execution Prevention (for T1553.005) : Consider blocking container file types at web and/or email gateways. Consider unregistering container file extensions in Windows File Explorer.

Detection Generic guidance

• Initial Access: Alert on unusual requests to the affected service (odd paths, oversized payloads, exploit strings) in WAF, reverse-proxy and application logs.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.