A significant denial-of-service vulnerability, identified as CVE-2025-53816, has been found within the popular compression software 7-Zip. This flaw specifically targets the software’s RAR5 decoder, enabling malicious actors to trigger system crashes. The vulnerability stems from a heap buffer overflow that occurs when 7-Zip attempts to process specially crafted RAR5 archive files, leading to memory corruption and the instability of the application or even the entire system.
Security researcher Jaroslav Lobačevski brought this critical issue, also known as GHSL-2025-058, to light.
The technical root cause lies in a miscalculation within the RAR5 decoder’s memory operation, specifically during the My_ZeroMemory function call. When attempting to repair corrupted archive items, the decoder incorrectly calculates the amount of memory to zero out, causing it to write data beyond allocated buffer boundaries. The severity of this overflow is influenced by attacker-controlled data from preceding archive items, making it particularly dangerous.
While this vulnerability primarily leads to denial-of-service attacks rather than arbitrary code execution, its impact is still substantial. The heap buffer overflow consistently overwrites memory locations with zeros when 7-Zip processes a malicious RAR5 file. This reliability in crashing the application and potentially the system makes it a potent tool for disruption, even if it doesn’t allow for direct code execution.
Testing has confirmed that both ASAN-compiled and official Windows builds of 7-Zip are affected.
The responsible disclosure process for this vulnerability was diligently followed. The issue was privately reported on April 24, 2025, and the 7-Zip development team promptly acknowledged it within five days. A successful fix was developed and subsequently released in 7-Zip version 25.00 on July 5, 2025, demonstrating an efficient remediation timeline of approximately two months from the initial report.
Given the critical nature of this denial-of-service vulnerability, it is imperative for all 7-Zip users to update their software immediately to version 25.00 or a later release. Furthermore, organizations should exercise extreme caution when handling RAR5 files from untrusted sources. Implementing additional security measures for archive processing workflows is also highly recommended to safeguard against potential exploitation of this and similar vulnerabilities.
Reference:
