CVE-2024-11477: 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…

PriorityP258high7.8CVSS 3.1

AVLACLPRNUIRSUCHIHAH

EPSS

21.98%

97.4th percentile

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
7-zip	7-zip	< 24.07	24.07
7-zip	7-zip	—	—
debian	7zip	< 7zip 24.07+dfsg-1 (forky)	7zip 24.07+dfsg-1 (forky)
debian	p7zip	< 7zip 24.07+dfsg-1 (forky)	7zip 24.07+dfsg-1 (forky)
google	chrome_chrome	—	—

Detection & IOCsextracted from sources · hover to see the quote

→The vulnerability exists in the Zstandard decompression implementation of 7-Zip; monitor for processing of maliciously crafted Zstandard-compressed archives via 7-Zip ↗
→Attack vectors may vary depending on implementation — any application embedding 7-Zip's Zstandard decompression library is a potential attack surface; audit third-party software bundling liblzma/7-Zip components ↗
→Code execution occurs in the context of the current process; look for unexpected child processes or memory corruption indicators spawned from 7-Zip or applications using its decompression library ↗

·Debian fix is version 24.07+dfsg-1; installations running earlier versions of the 7-Zip package on bookworm, forky, sid, and trixie are vulnerable — verify installed version is >= 24.07+dfsg-1 ↗
·Debian scope is listed as 'local' in the security tracker, which may affect prioritization in purely local-access environments, but the NVD description explicitly states remote attackers can exploit it depending on implementation context ↗
·ChromeOS LTS channel was also patched for this CVE, indicating the vulnerability affects embedded uses of 7-Zip/Zstandard beyond standalone 7-Zip installations ↗

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

osv7.8HIGH

vendor_debian7.8LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.