CVE-2025-53816: 
7-Zip vulnerability analysis and mitigation

CVE-2025-53816 is a heap-based buffer overflow vulnerability in 7-Zip's RAR5 handler that can lead to memory corruption and denial of service. It affects all versions of 7-Zip prior to 25.00 and was discovered by Jaroslav Lobačevski of the GitHub Security Lab (GHSL). The vulnerability was reported on 2025-04-24, fixed on 2025-07-05, and publicly disclosed on 2025-07-17. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Security Lab, Red Hat).

The root cause is a miscalculation of the rem variable in the RAR5 decoder's error-recovery logic (CWE-122: Heap-based Buffer Overflow). When 7-Zip's NCompress::NRar5::CDecoder encounters a corrupted RAR5 archive item, it attempts to recover by zeroing out memory; however, the computed rem = _lzEnd - lzSize value is inflated because _lzEnd is incremented by _unpackSize, which is derived from the size of the previous archive item — a value fully controlled by the attacker. This causes My_ZeroMemory(_window + _winPos, (size_t)rem) to write zeroes past the end of the allocated heap buffer. The attacker can craft a malicious RAR5 archive with a manipulated item size to control how many bytes beyond the buffer are overwritten, triggering the overflow when the archive is extracted (GitHub Security Lab, Openwall oss-security).

Successful exploitation causes memory corruption that crashes the 7-Zip process, resulting in a denial of service. Because the out-of-bounds write is always zeroes, arbitrary code execution is considered unlikely by the researcher, though the attacker controls the number of bytes overwritten. The vulnerability affects any system or pipeline that processes untrusted RAR5 archives with a vulnerable version of 7-Zip, including automated file processing services, email gateways, and backup systems (GitHub Security Lab, Openwall oss-security).

A proof-of-concept (PoC) exploit is publicly available, demonstrated by triggering a heap-buffer-overflow when extracting a crafted RAR5 file (e.g., 7zz e -so rar-crash.rar5), confirmed to crash the official 7-Zip build on Windows even without ASAN instrumentation. The CVSS v4.0 vector includes an exploit maturity of PROOF_OF_CONCEPT. The EPSS score is approximately 0.017% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the disclosure date (GitHub Security Lab, Openwall oss-security).

1. Craft a malicious RAR5 archive: Create a specially crafted .rar (RAR5 format) archive containing at least two items. Set the unpack size of the first item to a large attacker-controlled value so that _lzEnd is inflated beyond the actual window buffer size.
2. Introduce corruption: Ensure the archive data for the second item is corrupted or truncated so that the RAR5 decoder's solid-archive recovery path (Z7_RAR_RECOVER_SOLID_LIMIT) is triggered.
3. Deliver the archive: Send the crafted archive to the target — via email attachment, file share, download link, or any channel where the victim or an automated system will open it with 7-Zip.
4. Trigger extraction: The victim (or automated pipeline) extracts the archive using a vulnerable 7-Zip version (< 25.00), e.g., 7zz e malicious.rar5.
5. Heap buffer overflow occurs: The decoder computes an oversized rem value and calls My_ZeroMemory(_window + _winPos, (size_t)rem), writing zeroes past the allocated heap buffer, corrupting adjacent memory and crashing the process (GitHub Security Lab, Openwall oss-security).

• Process: Unexpected crash or abnormal termination of 7zz, 7z.exe, or 7-zip.exe processes when processing RAR5 archives; crash dump files generated in the 7-Zip working directory.
• Logs: Application error logs or Windows Event Viewer entries showing access violations or heap corruption faults originating from 7z.exe or 7zz; ASAN output containing heap-buffer-overflow in Rar5Decoder.cpp if debug builds are in use.
• File System: Presence of unexpected or malformed .rar files (RAR5 format) in monitored directories, particularly those with anomalously large declared unpack sizes for archive items.
• Network: Delivery of .rar attachments or downloads from untrusted sources to systems running vulnerable 7-Zip versions.

The primary remediation is to upgrade 7-Zip to version 25.00 or later, which contains the fix for this issue (released 2025-07-05). As a workaround, avoid opening or automatically processing RAR5 archive files from untrusted sources until the upgrade is applied. Organizations using automated file processing pipelines should restrict or sandbox RAR5 extraction operations. Linux distribution packages (e.g., p7zip for Debian/Ubuntu, openSUSE, Fedora) should also be updated to versions that incorporate the upstream fix (GitHub Security Lab, Red Hat Bugzilla).

The vulnerability was disclosed by the GitHub Security Lab on July 17, 2025, and received coverage from multiple security news outlets including CyberSecurityNews, GBHackers, SecurityOnline, and Heise. Social media posts on Mastodon (infosec.exchange) and Bluesky noted the disclosure shortly after publication. The vulnerability appeared in weekly threat landscape digests and CVE trending lists for the week of July 22–23, 2025, indicating moderate community interest. No significant vendor statements beyond the patch release and Red Hat's bug tracking entry have been observed (GitHub Security Lab, Openwall oss-security).