7-Zip Mark-of-the-Web (MotW) Bypass and Remote Code Execution Vulnerability (CVE-2025-0411)
Executive & SecOps Summary
SECOPS ASSESSMENTAll unpatched installations of 7-Zip software
When extracting files from a crafted archive, the Mark-of-the-Web (MotW) is not propagated, allowing arbitrary code execution under the current user context without security warnings
Immediately upgrade 7-Zip to the latest patched version and monitor unpatched endpoint assets
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update 7-Zip to the latest secure version. In enterprise environments, you can use winget or PowerShell to automate the deployment.
# Upgrade 7-Zip silently using Windows Package Manager (winget)
winget upgrade --id 7zip.7zip --silent --accept-source-agreements --accept-package-agreements2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict the execution of unapproved archive utilities via Group Policy (GPO) or AppLocker, and enforce strict endpoint monitoring on downloaded archives.
# PowerShell script to identify downloaded files missing Zone.Identifier stream in the Downloads folder
Get-ChildItem -Path '$env:USERPROFILE\Downloads' -Recurse | ForEach-Object {
$stream = Get-Item $_.FullName -Stream 'Zone.Identifier' -ErrorAction SilentlyContinue
if (-not $stream) {
Write-Warning 'Potential MotW bypass file detected: ' + $_.FullName
}
}3. Log Audit & IoC Verification Commands
Run the following PowerShell command to audit the installed version of 7-Zip across your endpoints to identify vulnerable assets.
# Query registry to detect installed 7-Zip version
$uninstallKeys = @(
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty -Path $uninstallKeys -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -like '*7-Zip*' } |
Select-Object DisplayName, DisplayVersion, InstallLocation | Format-Table -AutoSizeBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-0411) is a security feature bypass involving the Windows Mark-of-the-Web (MotW) mechanism. MotW relies on the 'Zone.Identifier' Alternate Data Stream (ADS) to flag files downloaded from untrusted zones, triggering SmartScreen or security warnings upon execution. The root cause lies in 7-Zip's archive extraction logic, which fails to propagate the MotW zone identifier from the parent archive to the extracted individual files.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious archive (such as .zip or .7z) containing executable payloads or scripts. When a victim downloads this archive, the OS correctly tags the archive with MotW. However, when the victim extracts the contents using a vulnerable version of 7-Zip, the extracted files do not inherit the MotW tag. Consequently, when the victim executes the extracted payload, Windows bypasses SmartScreen and security warnings, leading to silent arbitrary code execution in the context of the logged-in user.
3. Infrastructure & Business Impact
As this vulnerability is actively exploited in the wild and listed in the CISA KEV catalog, it poses an immediate threat to enterprise environments. Attackers can leverage this flaw in phishing campaigns to deliver malware, establish initial access, and perform lateral movement, potentially leading to ransomware deployment and catastrophic data breaches.
Official Vendor Advisories & References
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
Frequently Asked SecOps Questions (CVE-2025-0411)
FAQQ1. How critical is CVE-2025-0411 and is it actively exploited in the wild?
CVE-2025-0411 is rated CVSS 7.0 (HIGH) with a 30-day EPSS exploitation probability of 47.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-0411?
Primary impacted vendors include 7-zip across 7-zip. Scope summary: All unpatched versions of 7-Zip on Windows environments
Q3. What temporary mitigations or workarounds exist for CVE-2025-0411 before patching?
[Mitigation] Immediately upgrade 7-Zip to the latest patched version and monitor unpatched endpoint assets Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-0411
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (7-zip)
View Category →Google Pixel Cellular Modem Privilege Escalation Vulnerability (CVE-2026-58704) Security Advisory
[Affected Scope] Google Pixel devices and Android hardware utilizing specific cellular modem chipsets.
Microsoft Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510) Urgent Security Advisory
[Affected Scope] Windows Shell component across Microsoft Windows operating systems
Windows Shell Protection Mechanism Failure and Network Spoofing Vulnerability (CVE-2026-32202) Analysis and Mitigation Guide
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Shell component
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.