7-Zip: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes
WID-SEC-2025-2261 · first 13.10.2025 · updated 12.05.2026 · CVSS 7,0
What it is about
7-Zip ist ein Extraktionsdienstprogramm für Archive, die im ZIP-Format komprimiert sind. Ein Angreifer kann mehrere Schwachstellen in 7-Zip ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.
Under what conditions?
The BSI does not name any particular preconditions.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode mit den Rechten des Dienstes auszuführen
Am I affected?
Affected according to the BSI:
- Debian Linux
- Fedora Linux
- NetApp ActiveIQ Unified Manager for Microsoft Windows
- Open Source 7-Zip <25.00
- ABB 800xA <=7.0
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source 7-Zip 25.00
- ABB 800xA <=7.0
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- ZDI Advisory vom 2025-10-12 www.zerodayinitiative.com
- ZDI Advisory vom 2025-10-12 www.zerodayinitiative.com
- PoC auf GitHub vom 2025-10-19 pacbypass.github.io
- NHS Digital Cyber Alert vom 2025-11-19 digital.nhs.uk
- Fedora Security Advisory FEDORA-2025-B5A4903EA0 vom 2025-11-26 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-B6422D64F9 vom 2025-11-26 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-EPEL-2025-0A81D38451 vom 2025-11-26 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-EPEL-2025-2BED30C65F vom 2025-11-26 bodhi.fedoraproject.org
- NetApp Security Advisory NTAP-20260213-0012 vom 2026-02-13 security.netapp.com
- ABB Cyber Security Advisory vom 2026-03-31 search.abb.com
- Debian Security Advisory DLA-4576 vom 2026-05-11 lists.debian.org
CVE: CVE-2025-11001, CVE-2025-11002
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.