Critical 7-Zip Vulnerabilities Enable Remote Code Execution Attacks

Two major security flaws have been discovered in 7-Zip that could allow attackers to compromise Windows systems through malicious ZIP files.

The Vulnerabilities: CVE-2025-11001 and CVE-2025-11002

These critical vulnerabilities enable directory traversal attacks, allowing malicious ZIP files to:

• Escape the original extraction directory
• Write files to unauthorized system areas
• Execute arbitrary code with user privileges
• Potentially compromise entire Windows environments

Low Complexity Exploitation

The attack vector is dangerously simple:

• Users only need to open or extract a malicious ZIP file
• No additional user interaction required
• Exploitation complexity is minimal

Immediate Action Required

Update to version 25.01 or later to patch these vulnerabilities.

The fix is available now, and security experts strongly recommend immediate updates to prevent potential system compromise.