CVE-2025-0411
7-Zip Mark of the Web Bypass Vulnerability
Description
CVE-2025-0411 is a high-severity vulnerability in 7-Zip that allows remote attackers to bypass the Mark-of-the-Web (MotW) protection mechanism on affected installations. With a CVSS v3.1 base score of 7.0, the flaw exists in how 7-Zip handles archived files, failing to propagate MotW protections to files extracted from nested archives, which can result in arbitrary code execution in the context of the current user. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 27, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 33.82% at the 96.9th percentile signals exceptionally high exploitation probability, placing this vulnerability in the most actively targeted tier of all tracked vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netapp | active iq unified manager | - |
| 7-zip | 7-zip | < 24.09 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.zerodayinitiative.com/advisories/ZDI-25-045/(Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2025/01/24/6(Mailing List)
- https://security.netapp.com/advisory/ntap-20250207-0005/(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-0411-7-zip-mitigation-vulnerability(Mitigation)
- https://www.vicarius.io/vsociety/posts/cve-2025-0411-detection-7-zip-vulnerability(Mitigation)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0411(US Government Resource)
Weakness Type
Unknown CWE
CVE-2025-0411 does not have an officially assigned CWE classification in the NVD database. However, the vulnerability is fundamentally a security feature bypass related to the improper propagation of the Mark-of-the-Web (MotW) flag during archive extraction. When a file is downloaded from the internet, Windows assigns it an Alternate Data Stream (ADS) tag called Zone.Identifier that marks it as originating from an untrusted source. This MotW flag triggers Windows SmartScreen and other security checks before execution. The flaw in 7-Zip occurs when files are extracted from crafted double-nested archives — the MotW flag from the outer archive is not propagated to the contents of the inner archive. This effectively strips the security marking from potentially malicious files, allowing them to execute without the standard Windows security prompts. Learn more about Mark-of-the-Web bypass techniques
Impact Analysis
The impact of CVE-2025-0411 is significant across all three pillars of the CIA triad, each rated as high. Confidentiality is fully at risk because bypassing the MotW protection allows malicious executables and scripts to run without SmartScreen warnings, enabling attackers to deploy information-stealing malware, keyloggers, or remote access tools that exfiltrate sensitive data from the target system without the user ever seeing a security prompt.
Integrity suffers maximum impact because once a malicious payload executes unimpeded by MotW-triggered protections, the attacker can modify files, install persistent backdoors, alter system configurations, and tamper with application data. The bypass effectively removes the first line of defense that Windows provides against downloaded malicious content, meaning any executable extracted from a crafted double-nested archive runs with the same trust level as a locally created file.
Availability is critically threatened as unrestricted code execution enables deployment of ransomware, wipers, or denial-of-service payloads. The EPSS score of 33.82% at the 96.9th percentile confirms that threat actors are actively exploiting this bypass in real-world attack campaigns. The attack does require user interaction — the victim must open a malicious archive — and high attack complexity due to the double-nesting requirement, but social engineering through phishing emails with archive attachments remains an extremely effective delivery mechanism. Organizations running 7-Zip versions prior to 24.09 should treat this as an urgent patching priority, particularly given the widespread use of 7-Zip in enterprise environments. NetApp Active IQ Unified Manager is also listed as an affected product.
Exploit Maturity
CVE-2025-0411 demonstrates high exploit maturity through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025. The EPSS score of 33.82% at the 96.9th percentile reflects extremely active exploitation, placing this vulnerability among the top 3% most exploited vulnerabilities tracked globally. The Zero Day Initiative published a detailed advisory at ZDI-25-045, and the vulnerability was also discussed on the oss-security mailing list.
The MotW bypass technique used in CVE-2025-0411 has been observed in real-world attack campaigns where threat actors deliver malicious payloads inside double-nested archives via phishing emails. The attack chain typically involves sending a specially crafted .7z archive containing another archive, where the inner archive holds the malicious executable. When the victim extracts the outer archive with a vulnerable version of 7-Zip, the inner archive's contents lose their MotW flag. When those files are subsequently extracted and executed, Windows SmartScreen does not intervene. Mitigation guidance is available from Vicarius, and the CISA KEV entry can be reviewed at the KEV catalog. The ransomware association is currently unknown, but MotW bypass vulnerabilities are a preferred delivery mechanism for ransomware operators who rely on users opening phishing attachments.
Remediation
-
Upgrade 7-Zip to version 24.09 or later immediately on all systems. The vulnerability affects all versions of 7-Zip prior to 24.09. Download the patched version from the official 7-Zip website and deploy it through your software distribution mechanism. Since 7-Zip does not include an automatic update feature, manual deployment or enterprise software management tools are required.
-
Audit enterprise-wide 7-Zip installations to identify all systems running vulnerable versions. Many organizations have multiple versions of 7-Zip deployed across endpoints due to the lack of centralized update management. Use endpoint detection tools or software inventory systems to create a comprehensive list of affected machines and prioritize patching.
-
Implement email gateway filtering to block or quarantine double-nested archive attachments as an interim mitigation. Configure email security solutions to inspect archive contents recursively and flag messages containing nested archives, particularly .7z files containing other .7z or .zip archives, as these are the primary delivery mechanism for exploiting this vulnerability.
-
Enable Windows Attack Surface Reduction (ASR) rules to block execution of potentially malicious downloaded files even when MotW is stripped. Specifically, enable rules that prevent Office applications from creating child processes, block executable content from email and webmail clients, and restrict execution of scripts and executables that do not meet prevalence, age, or trusted list criteria.
-
Educate users about phishing risks involving archive attachments. Inform users that they should exercise caution when opening archive files received via email, especially if those archives contain additional nested archives. Report any suspicious archive attachments to the security team before extracting contents.
Technical Details
CVE-2025-0411 is a Mark-of-the-Web bypass vulnerability in 7-Zip, characterized by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:L) indicates the attack requires the victim to locally interact with a malicious file, specifically by opening and extracting an archive. Attack Complexity (AC:H) reflects the requirement for a specifically crafted double-nested archive structure to trigger the MotW bypass. Privileges Required (PR:N) means no authentication is needed — the attacker only needs the victim to open the archive. User Interaction (UI:R) confirms the victim must actively open the malicious archive for exploitation to occur. Scope (S:U) indicates the impact remains within the context of the current user session.
The technical mechanism involves the Mark-of-the-Web Alternate Data Stream (ADS) Zone.Identifier that Windows applies to files downloaded from the internet. When 7-Zip extracts a top-level archive that carries this MotW flag, it correctly propagates the flag to the extracted files. However, when the extracted contents include another archive file, and the user subsequently extracts that inner archive, the MotW flag is not propagated to the files within the inner archive. This occurs because 7-Zip's extraction logic treats the inner archive as a locally created file rather than one originating from an untrusted source. The result is that executables, scripts, and other potentially dangerous files extracted from the inner archive lack the Zone.Identifier ADS, causing Windows SmartScreen to skip its security check. The vulnerability affects 7-Zip versions prior to 24.09 and also impacts NetApp Active IQ Unified Manager which bundles 7-Zip.
Frequently Asked Questions
What is CVE-2025-0411?
CVE-2025-0411 is a high-severity vulnerability in 7-Zip versions prior to 24.09 that allows attackers to bypass the Windows Mark-of-the-Web (MotW) protection. By using double-nested archives, extracted files lose their MotW security flag, enabling malicious code to execute without Windows SmartScreen warnings.
How does the Mark-of-the-Web bypass work in CVE-2025-0411?
When a user downloads a .7z archive from the internet, Windows marks it with the MotW flag. If that archive contains another archive inside it, 7-Zip fails to propagate the MotW flag to the inner archive's contents during extraction. Files extracted from the inner archive can then execute without triggering SmartScreen security prompts.
Which versions of 7-Zip are affected by CVE-2025-0411?
All versions of 7-Zip prior to version 24.09 are vulnerable. Users should upgrade to 7-Zip 24.09 or later to resolve this issue. NetApp Active IQ Unified Manager is also affected since it bundles 7-Zip.
Is CVE-2025-0411 being actively exploited?
Yes, CVE-2025-0411 has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 27, 2025. With an EPSS score of 33.82% at the 96.9th percentile, it is among the most actively exploited vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.