---
title: "CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability"
url: https://erroneo.us/security/cve/CVE-2025-0411/
description: "CVE-2025-0411 (7-Zip 7-Zip): Exploited in the wild (CISA KEV). 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-01-25
date_modified: 2026-02-26
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-0411"
kev: true
cvss: 7
epss: 0.67071
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-0411: 7-Zip Mark of the Web Bypass Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run 7-Zip 7-Zip. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2025-02-06, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-02-27 ; treat that as the outer limit, not the target.
- EPSS 67.1% , percentile 99: FIRST’s model estimates a 67.1% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs local access needed. Lower urgency for most teams unless an attacker could already run code on the machine.

## What it is

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

## Affected products (CVE record)

- 7-Zip 7-Zip: 24.08 (x64)

## Severity

- zdi CVSS 3.0: 7 `CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2025-02-06; federal due date 2025-02-27. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 67.07% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [Listed in CISA KEV notes (7-zip.org)](https://www.7-zip.org/history.txt)
- [CVE.org record CVE-2025-0411](https://www.cve.org/CVERecord?id=CVE-2025-0411)
- [NVD entry CVE-2025-0411](https://nvd.nist.gov/vuln/detail/CVE-2025-0411)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0411)
- [ZDI-25-045](https://www.zerodayinitiative.com/advisories/ZDI-25-045/)
- [openwall.com](http://www.openwall.com/lists/oss-security/2025/01/24/6)
- [vicarius.io](https://www.vicarius.io/vsociety/posts/cve-2025-0411-detection-7-zip-vulnerability)
- [vicarius.io](https://www.vicarius.io/vsociety/posts/cve-2025-0411-7-zip-mitigation-vulnerability)
- [security.netapp.com](https://security.netapp.com/advisory/ntap-20250207-0005/)

---
Source page: https://erroneo.us/security/cve/CVE-2025-0411/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt