CVE-2024-11477

7-Zip contains a remote code execution flaw in its Zstandard (zstd) decompression implementation, where insufficient validation of user-supplied data allows an integer underflow before writing to memory. Exploitation requires interaction with the library — typically an application or user processing a crafted Zstandard-compressed stream or archive — and the attack vector can vary depending on how 7-Zip is integrated. A successful attacker executes arbitrary code in the context of the current process, gaining the privileges of whatever application invoked the decompressor. Anyone running an affected 7-Zip installation whose workflows decompress Zstandard data is exposed, with the highest risk on endpoints where users open untrusted archives. As of publication there is no entry in CISA's KEV and no known public proof-of-concept, but a high EPSS score (22.6% probability of exploitation within 30 days, 98th percentile) indicates an elevated near-term exploitation risk.

What to do: Upgrade 7-Zip to the latest release available from 7-zip.org and audit third-party applications that bundle or embed 7-Zip components (e.g., 7z.dll) to process archives, updating those as vendors patch. Until patched, avoid opening Zstandard-compressed archives or streams from untrusted sources, since the CVSS vector indicates user interaction is required and the attack surface varies with how the library is integrated.