Skip to main content

7 Zip CVE-2016-7804

HIGH
Untrusted Search Path (CWE-426)
2017-05-22 vultures@jpcert.or.jp
7.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
May 22, 2017 - 16:29 cve.org
HIGH 7.8

DescriptionCVE.org

Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

AnalysisAI

Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-426. Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. Affected products include: 7-Zip.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in 7 Zip

View all
CVE-2016-2334 HIGH POC
7.8 Dec 13

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows

CVE-2016-2335 HIGH POC
8.8 Jun 07

The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attacke

CVE-2022-29072 HIGH POC
7.8 Apr 15

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is d

CVE-2018-10115 HIGH POC
7.8 May 02

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memor

CVE-2018-5996 HIGH POC
7.8 Jan 31

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead

CVE-2025-53816 MEDIUM POC
5.5 Jul 17

Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and d

CVE-2026-58052 MEDIUM POC
4.8 Jun 28

Mark-of-the-Web protection is bypassed in 7-Zip for Windows 26.02 and earlier when extracting crafted RAR5 archives, all

CVE-2018-10172 HIGH
8.8 Apr 16

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to

CVE-2025-11002 HIGH
7.8 Jan 23

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attacke

CVE-2023-31102 HIGH
7.8 Nov 03

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive. Rated hig

CVE-2022-47112 LOW POC
2.5 Apr 19

7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Rated low s

CVE-2022-47111 LOW POC
2.5 Apr 19

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Rated low se

Share

CVE-2016-7804 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy