CVE-2025-53816 GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder

What is CVE-2025-53816?

CVE-2025-53816 is a medium-severity memory corruption vulnerability in ipavlov 7-Zip, published on 17 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Weakness: CWE-122

Which versions are affected by CVE-2025-53816?

It affects 1 product.

Products include 7-Zip 7-Zip.

How do I fix CVE-2025-53816?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-53816 being exploited?

There is no known exploitation of CVE-2025-53816 in the wild and no public exploit code.

Other vulnerabilities in ipavlov 7-Zip

• CVE-2025-0411 7-Zip Mark of the Web Bypass Exploited High 7.0
• CVE-2008-6536 Other in n/a Critical 10.0
• CVE-2026-48095 GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation High 8.8
• CVE-2018-10172 Privilege escalation in n/a High 8.8
• CVE-2016-2335 Memory corruption in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as DEBIAN-CVE-2025-53816, UBUNTU-CVE-2025-53816.