CVE-2025-0411
HighExploitedPublic exploit7-Zip Mark-of-the-Web Bypass Vulnerability.
Published Jan 25, 2025 · Updated Feb 26, 2026 · Also known as UBUNTU-CVE-2025-0411
Key Facts
Patch immediately- CVE-2025-0411 is a high-severity vulnerability (CVSS 7.0 v3.1) affecting 7-Zip, Active Iq Unified Manager (Netapp), 7zip (debian) and 1 more product.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 4, 2025. Public exploit code is available.
- EPSS estimates a 67% probability of exploitation in the next 30 days.
- Fixed versions are available, including 7-Zip 24.09, 7zip 0, p7zip 0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.0
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
67%
Higher than 99.2% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2025-0411 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Feb 6, 2025 | Feb 27, 2025 | Not reported |
| Industry KEV feed | Feb 4, 2025 | Feb 27, 2025 | Not reported |
| CIRCL KEV | Feb 6, 2025 | Feb 27, 2025 | Not reported |
| ENISA EUVD | Feb 6, 2025 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Products
10 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| 7-Zip7-Zip | >= 24.08 (x64) | 24.09 |
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| 7zipdebian | See advisory | 0 |
| p7zipdebian | See advisory | 0 |
Patched Releases
7-Zip
24.09
Timeline
Publicly disclosed
Jan 25, 2025
Added to Industry KEV feed
Feb 4, 2025
Added to CISA KEV
Feb 6, 2025
Added to CIRCL KEV
Feb 6, 2025
Added to ENISA EUVD
Feb 6, 2025
Last updated
Feb 26, 2026
Weakness Type
- CWE-693 Protection Mechanism Failure
References
- advisoryhttps://security.netapp.com/advisory/ntap-20250207-0005/
- advisoryhttps://ubuntu.com/security/CVE-2025-0411
- advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2025-0411
- advisoryZDI-25-045
FAQ
Common Questions.
7-Zip Mark-of-the-Web Bypass Vulnerability.
Affected: 7-Zip versions >= 24.08 (x64); Active Iq Unified Manager (Netapp); 7zip (debian), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 4, 2025.
Yes. It was added on Feb 6, 2025 with a federal remediation due date of Feb 27, 2025.
Public exploit code is available.
Fixed versions are available, including 7-Zip 24.09, 7zip 0, p7zip 0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2025-0411 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo