CVE-2025-53817: 
7-Zip vulnerability analysis and mitigation

CVE-2025-53817 is a null pointer dereference vulnerability in 7-Zip's Compound Document handler that can lead to denial of service. It affects all 7-Zip versions prior to 25.00, including the tested version 24.09. The vulnerability was discovered by Jaroslav Lobačevski of the GitHub Security Lab, reported privately on 2025-04-24, fixed on 2025-07-05 in v25.00, and publicly disclosed on 2025-07-17. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Security Lab, Red Hat).

The root cause is a NULL Pointer Dereference (CWE-476) in the NArchive::NCom::CHandler::GetStream function within ComHandler.cpp. When a Compound Document item's item.Size is a specially crafted large value, the expression (item.Size + clusterSize - 1) >> bsLog overflows, causing numClusters64 to become zero. The existing bounds check if (numClusters64 >= ((UInt32)1 << 31)) does not catch this unsigned integer overflow condition, so ClearAndReserve(0) is called, leaving the internal vector pointer as null. A subsequent write attempt via Vector.AddInReserved() then dereferences the null pointer, crashing the process. The vulnerability is triggered locally when a user opens or extracts a maliciously crafted Compound Document file, and a public proof-of-concept (PoC) is available (GitHub Security Lab, oss-security).

Successful exploitation causes 7-Zip to crash, resulting in a denial of service for the application. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. On Windows, the official 7-Zip build crashes without any special instrumentation, while on Linux the crash is confirmed with ASAN-compiled builds. The impact is confined to the 7-Zip process itself and does not enable code execution, privilege escalation, or lateral movement (GitHub Security Lab).

A public proof-of-concept (compound-crash.poc) is available and was published alongside the coordinated disclosure by the GitHub Security Lab (GitHub Security Lab, oss-security). The CVSS v4.0 exploit maturity is rated "Proof of Concept." There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term (Feedly).

1. Craft malicious Compound Document: Create a specially crafted Compound Document file where an item's Size field is set to a value that causes (item.Size + clusterSize - 1) >> bsLog to overflow to zero when processed by 7-Zip's Compound handler.
2. Deliver the file to the target: Distribute the malicious .doc, .xls, .ppt, or other Compound Document format file to a victim via email attachment, file share, or download link, relying on social engineering to prompt the user to open or extract it with 7-Zip.
3. Trigger extraction: The victim opens the file with a vulnerable version of 7-Zip (prior to 25.00), for example using 7zz e compound-crash.poc or via the GUI.
4. Null pointer dereference triggered: The Compound handler's GetStream function computes numClusters64 = 0 due to overflow, calls ClearAndReserve(0) leaving the vector pointer null, then attempts Vector.AddInReserved() on the null pointer, causing a segmentation fault/crash.
5. Denial of service achieved: The 7-Zip process crashes, denying the user access to the application until it is restarted (GitHub Security Lab, oss-security).

• Process: Unexpected crash or termination of the 7zz, 7z, or 7-Zip process when opening or extracting a Compound Document file.
• Logs: Application crash logs or Windows Error Reporting entries referencing ComHandler.cpp or MyVector.h in the stack trace; ASAN output showing SEGV on unknown address 0x000000000000 with a WRITE memory access.
• File System: Presence of unexpected or unsolicited Compound Document files (.doc, .xls, .ppt, .msi, etc.) in download directories or temporary folders that were not created by the user.
• Network: Unusual inbound delivery of Compound Document files from untrusted or external sources, particularly if followed by a 7-Zip process crash (GitHub Security Lab).

The primary remediation is to upgrade 7-Zip to version 25.00 or later, which contains the fix for this vulnerability (released 2025-07-05) (GitHub Security Lab). As a workaround, avoid opening or extracting untrusted Compound Document files with 7-Zip until the upgrade is applied. Organizations can also implement file validation policies to restrict processing of Compound Documents from untrusted sources, and use application whitelisting to enforce use of patched versions only (Red Hat).

The GitHub Security Lab published the advisory (GHSL-2025-059) and announced it on Bluesky and Mastodon/Infosec.exchange, noting coordinated disclosure with the 7-Zip maintainer (GitHub Security Lab). SecurityOnline.info covered the vulnerability alongside a related 7-Zip DoS issue in an article titled "Two Vulnerabilities in 7-Zip Could Trigger Denial of Service." Red Hat and ENISA (EUVD-2025-21790) tracked the vulnerability, and it was picked up by multiple vulnerability aggregators and Linux distribution security teams including openSUSE, Fedora, and Debian (p7zip). Community reaction has been measured given the limited impact (DoS only, no code execution).