Wednesday, April 30, 2025
HomeCVE/vulnerabilityWinZip Vulnerability Allows Remote Attackers to Execute Arbitrary Code

WinZip Vulnerability Allows Remote Attackers to Execute Arbitrary Code

Published on

SIEM as a Service

Follow Us on Google News

A newly discovered vulnerability in WinZip, a popular file compression and archiving utility, has raised alarms among cybersecurity experts.

Identified as CVE-2025-1240, this critical flaw allows remote attackers to execute arbitrary code on a victim’s system under specific conditions. Users are strongly advised to update their software to mitigate the risk.

Key Details of the Vulnerability

The vulnerability, disclosed under ZDI-25-047 and ZDI-CAN-24986, stems from an issue in the parsing of 7Z files—a file format commonly associated with compressed archives.

- Advertisement - Google News

Improper validation of user-supplied data can result in an out-of-bounds write, enabling attackers to potentially execute malicious code in the current process.

This flaw has earned a CVSS score of 7.8 (High), reflecting its severity and potential impact on confidentiality, integrity, and availability.

For the attack to succeed, user interaction is required, such as opening a malicious 7Z file or visiting a hosting webpage.

Despite requiring user interaction, the possibility of executing arbitrary code makes this vulnerability highly dangerous, particularly as it could lead to full system compromise if exploited successfully.

As per a report by Zero Day Initiative, the vulnerability was initially reported to the vendor, WinZip Computing, on September 4, 2024. 

Following months of investigation and remediation efforts, an official patch was released as part of WinZip 29.0. 

The advisory was publicly disclosed on January 20, 2025, and later updated on February 11, 2025, to include further clarifications.

To address the issue, users are strongly urged to update their software to WinZip 29.0 or later.

The update incorporates fixes to the parsing mechanism, ensuring better validation and secure handling of 7Z files.

The discovery of the flaw has been credited to an anonymous researcher.

The incident highlights the persistent need to ensure software security, particularly for widely used utilities like WinZip.

As cyber threats evolve, users must remain vigilant and proactive in applying security patches.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

How CISOs Can Strengthen Supply Chain Security in 2025

The responsibilities of Chief Information Security Officers (CISOs) are rapidly evolving as digital transformation...

The CISO’s Guide to Effective Cloud Security Strategies

As organizations accelerate cloud adoption, CISOs face unprecedented challenges securing dynamic, multi-cloud environments. The...

Mitigating Insider Threats – A CISO’s Practical Approach

Insider threats represent one of the most challenging cybersecurity risks facing organizations today, with...

Security Policy Development Codifying NIST CSF For Enterprise Adoption

The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) has become a...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Security Policy Development Codifying NIST CSF For Enterprise Adoption

The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) has become a...

Cato Networks macOS Client Vulnerability Enables Low-Privilege Code Execution

A critical vulnerability in Cato Networks’ widely used macOS VPN client has been disclosed,...

TheWizards Deploy ‘Spellbinder Hacking Tool’ for Global Adversary-in-the-Middle Attack

ESET researchers have uncovered sophisticated attack techniques employed by a China-aligned threat actor dubbed...