WinZip Vulnerability Let Remote Attackers Execute Arbitrary Code
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A newly disclosed high-severity vulnerability in WinZip, tracked as CVE-2025-1240, enables remote attackers to execute arbitrary code on affected systems by exploiting malformed 7Z archive files.<\/p>\n
The flaw, rated 7.8 on the CVSS scale, impacts WinZip 28.0 (Build 16022) and earlier versions, requiring users to update to WinZip 29.0 to mitigate risks.<\/p>\n
The vulnerability arises from inadequate validation of 7Z file data during parsing, permitting attackers to create malicious archives that cause an\u00a0out-of-bounds write\u00a0in memory.<\/p>\n
This corruption can be leveraged to execute code within the context of the WinZip process, potentially enabling full system compromise if paired with additional exploits.<\/p>\n
Security firm Zero Day Initiative (ZDI) detailed<\/a> the flaw as ZDI-CAN-24986, noting its potential for widespread abuse given WinZip\u2019s global user base.<\/p>\n Successful exploitation grants attackers the same privileges as the logged-in user. This could lead to:<\/p>\n While the attack requires user interaction, the prevalence of 7Z files in software distribution and data sharing increases the likelihood of successful phishing campaigns.<\/p>\n WinZip Computing addressed the flaw<\/a> in version 29.0 (Build 16250), released in December 2024. The update also introduced enhanced security measures, including:<\/p>\n This vulnerability follows a surge in file-parsing exploits, including a recent Windows OLE zero-click flaw (CVE-2025-21298<\/a>) that allowed RCE via malicious emails. Such incidents underscore the importance of proactive patch management, particularly for widely used utilities like WinZip, which handles over 1 billion compressed files annually.<\/p>\n Security analysts urge organizations to prioritize updating affected software and educate users on recognizing suspicious file attachments.<\/p>\n WinZip\u2019s prompt response to CVE-2025-1240 highlights the critical role of vendor accountability in cybersecurity. Users and enterprises are advised to apply updates swiftly to neutralize this high-risk threat.<\/p>\n PCI DSS 4.0 & Supply Chain Attack Prevention \u2013\u00a0Free Webinar<\/a><\/strong><\/p>\n The post WinZip Vulnerability Let Remote Attackers Execute Arbitrary Code<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nImpact and Risks<\/strong><\/h4>\n
\n
Mitigation and Patches<\/strong><\/h4>\n
\n
\nRecommendations for Users<\/strong>:<\/h4>\n
\n