CVE-2025-0411 7-Zip Mark of the Web Bypass
Attackers can bypass Mark-of-the-Web protections in 7-Zip to execute arbitrary code by tricking users into opening malicious archives.
- Exploited in the wild
- Since 6 Feb 2025
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-0411?
CVE-2025-0411 is a high-severity vulnerability in Netapp Active Iq Unified Manager, published on 25 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
Weakness: CWE-693
Which versions are affected by CVE-2025-0411?
It affects 2 products.
Products include 7-Zip 7-Zip, Netapp Active Iq Unified Manager.
How do I fix CVE-2025-0411?
Upgrade to a fixed version. US federal agencies must fix it by 27 Feb 2025.
Is CVE-2025-0411 being exploited?
Yes. Attackers have exploited CVE-2025-0411 in the wild since at least 6 Feb 2025.
Public exploit code: 6 proofs of concept on GitHub.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2008-6536 Other in n/a
- CVE-2026-48095 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation
- CVE-2018-10172 Privilege escalation in n/a
- CVE-2016-2335 Memory corruption in n/a
- CVE-2024-11477 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability
Sources
Also known as CLEANSTART-2025-EQ95920, GHSA-2pjx-wvcg-vhr8.