CVE-2022-29072: 7-Zip Privilege Escalation Vulnerability

CVE-2022-29072 Overview

CVE-2022-29072 is a heap overflow vulnerability affecting 7-Zip through version 21.07 on Windows systems. The vulnerability allows privilege escalation and arbitrary command execution when a specially crafted file with the .7z extension is dragged to the Help>Contents area within the 7-Zip File Manager (7zFM.exe). This is caused by a misconfiguration of 7z.dll combined with a heap overflow condition. When exploited, commands execute in a child process under the 7zFM.exe process.

It should be noted that multiple third parties have disputed the severity of this vulnerability, reporting that no privilege escalation can actually occur in practical scenarios.

Critical Impact

Local attackers with low privileges can potentially achieve code execution and privilege escalation by exploiting the heap overflow in 7-Zip's Help functionality, affecting confidentiality, integrity, and availability of the system.

Affected Products

• 7-Zip versions through 21.07
• Microsoft Windows (all versions running affected 7-Zip)
• Systems with 7-Zip File Manager (7zFM.exe) installed

Discovery Timeline

• 2022-04-15 - CVE-2022-29072 published to NVD
• 2025-06-09 - Last updated in NVD database

Technical Details for CVE-2022-29072

Vulnerability Analysis

CVE-2022-29072 is classified as CWE-787 (Out-of-bounds Write), specifically manifesting as a heap overflow vulnerability. The flaw exists within the 7-Zip File Manager application and its interaction with the Help system. When a user drags a maliciously crafted .7z file to the Help>Contents area, the application improperly handles the input, leading to a heap buffer overflow condition.

The vulnerability stems from the misconfiguration of 7z.dll, which fails to properly validate input boundaries when processing archive files in the context of the Help system. This allows an attacker to corrupt heap memory, potentially overwriting critical data structures that control program execution flow.

Root Cause

The root cause of this vulnerability is twofold:

1. Misconfiguration of 7z.dll: The dynamic link library responsible for handling 7-Zip archive operations does not properly sanitize or validate input when invoked through the Help system interface.

2. Heap Overflow: When processing the malicious .7z file, the application allocates insufficient heap memory or fails to perform proper bounds checking, allowing data to be written beyond the allocated buffer boundaries.

The combination of these factors creates a condition where memory corruption can be triggered through a seemingly innocuous user interaction with the Help menu.

Attack Vector

The attack requires local access to the target system and user interaction. The attack scenario proceeds as follows:

1. An attacker crafts a malicious .7z archive file designed to trigger the heap overflow
2. The attacker must convince a user to drag this file to the Help>Contents area in 7-Zip File Manager
3. When the file is processed, the heap overflow occurs, corrupting memory structures
4. The corrupted memory can redirect execution flow to attacker-controlled code
5. Malicious commands execute in a child process spawned by 7zFM.exe

The vulnerability requires local access (the attacker must be able to place a file on the target system) and low privileges. No authentication is required beyond basic system access, but user interaction is needed to trigger the exploit condition.

Detailed proof-of-concept information is available at the GitHub PoC repository and Packet Storm.

Detection Methods for CVE-2022-29072

Indicators of Compromise

• Unexpected child processes spawned under 7zFM.exe executing suspicious commands
• Unusual access patterns to the Help system functionality within 7-Zip
• Process execution chains showing 7zFM.exe as parent process for unexpected executables
• Heap memory corruption crashes or unexpected termination of 7zFM.exe

Detection Strategies

• Monitor process creation events where 7zFM.exe is the parent process, particularly looking for command interpreters (cmd.exe, powershell.exe) or unusual executables
• Implement behavioral analysis to detect anomalous interactions between .7z files and the Help system
• Deploy endpoint detection rules that alert on heap corruption indicators or access violation exceptions in 7zFM.exe
• Use application whitelisting to prevent unauthorized child process execution from 7-Zip

Monitoring Recommendations

• Enable Windows Event Logging for process creation (Event ID 4688) with command line auditing to capture suspicious process chains
• Configure SentinelOne behavioral AI to detect unusual process hierarchies involving 7zFM.exe
• Monitor for access to 7z.dll in conjunction with Help system invocations
• Set up alerts for any crash dumps or access violations originating from 7-Zip components

How to Mitigate CVE-2022-29072

Immediate Actions Required

• Update 7-Zip to the latest available version beyond 21.07
• Remove the 7-Zip Help file (7-zip.chm) as a temporary workaround if updating is not immediately possible
• Educate users not to drag untrusted files to the Help menu area
• Consider deploying application control policies to restrict 7-Zip's ability to spawn child processes
• Monitor for exploitation attempts using endpoint detection and response (EDR) solutions

Patch Information

Users should upgrade 7-Zip to a version newer than 21.07 where this issue has been addressed. The vendor bug tracker at SourceForge Bug Report #2337 contains additional information about the fix status.

Organizations should prioritize this update in their patch management cycle, particularly for systems where users regularly handle archive files from untrusted sources.

Workarounds

• Delete or rename the 7-zip.chm help file located in the 7-Zip installation directory (typically C:\Program Files\7-Zip\7-zip.chm) to prevent the Help system from being accessed
• Restrict user permissions to prevent modification of files in trusted directories
• Implement application control policies using SentinelOne or similar solutions to prevent 7zFM.exe from spawning unauthorized child processes
• Deploy network segmentation to limit the impact of potential local privilege escalation

# Remove the 7-Zip help file as a workaround
del "C:\Program Files\7-Zip\7-zip.chm"

# Alternatively, rename the file to prevent access
ren "C:\Program Files\7-Zip\7-zip.chm" "7-zip.chm.disabled"