CVE-2025-44089 Overview
CVE-2025-44089 is an arbitrary code execution vulnerability in NCH Software ExpressZip v11.29. Attackers can execute arbitrary code by tricking a user into downloading and opening a crafted archive file. The flaw affects the archive handling logic in the ExpressZip application, turning a routine file extraction workflow into a code execution primitive.
Because ExpressZip is a widely distributed consumer and small business archiving utility, this vulnerability presents a phishing-friendly attack path. A single malicious archive delivered via email, download link, or shared drive is sufficient to compromise the endpoint.
Critical Impact
Arbitrary code execution on the victim endpoint through a crafted archive processed by ExpressZip v11.29.
Affected Products
- NCH Software ExpressZip v11.29
Discovery Timeline
- 2026-07-22 - CVE-2025-44089 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2025-44089
Vulnerability Analysis
The vulnerability resides in how ExpressZip v11.29 parses and processes archive files. A crafted archive causes the application to execute code supplied or controlled by the attacker rather than safely extracting contents. Public details are limited, and no CWE identifier has been assigned in the NVD record.
Successful exploitation runs code in the security context of the user who opens the archive. On typical Windows workstations, this yields immediate access to user data, credentials cached by the browser, and a foothold for lateral movement. The vulnerability requires user interaction, aligning it with common phishing and drive-by download tradecraft.
Root Cause
The root cause is not detailed in the public NVD entry. The behavior described — code execution triggered by processing a crafted archive — is consistent with archive parsing flaws such as path traversal during extraction, unsafe handling of embedded executables, or memory corruption during header parsing. Refer to the GitHub CVE-2025-44089 Reference for the researcher's technical notes.
Attack Vector
Exploitation requires the victim to download and open a crafted archive file with ExpressZip v11.29. Delivery vectors include phishing emails with archive attachments, malicious download links, compromised software distribution sites, and shared cloud storage. No authentication to the vendor product is required, and no network-facing service is exposed. The attacker must convince the user to interact with the malicious archive.
The vulnerability mechanism is described in prose only because no verified proof-of-concept code is available. See the GitHub CVE-2025-44089 Reference for additional context.
Detection Methods for CVE-2025-44089
Indicators of Compromise
- Unexpected child processes spawned by ExpressZip.exe, particularly cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
- Archive files with unusual internal structures, oversized headers, or embedded executables landing in user download or temp directories.
- New persistence entries (Run keys, scheduled tasks, startup folder items) created shortly after ExpressZip archive extraction.
Detection Strategies
- Monitor process lineage for ExpressZip spawning interpreters or LOLBins outside normal archive workflows.
- Alert on file writes by ExpressZip to sensitive paths such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup or system directories.
- Hunt for outbound network connections initiated by ExpressZip or its child processes, which is atypical behavior for an archiving utility.
Monitoring Recommendations
- Ingest endpoint process, file, and network telemetry into a centralized data lake for retrospective hunting against archive-borne threats.
- Track ExpressZip version inventory across the environment to identify hosts still running v11.29.
- Correlate email gateway detections of archive attachments with endpoint execution events involving ExpressZip.
How to Mitigate CVE-2025-44089
Immediate Actions Required
- Inventory all endpoints running NCH Software ExpressZip v11.29 and prioritize remediation on high-risk systems.
- Block or quarantine untrusted archive attachments at the email gateway pending vendor guidance.
- Instruct users to avoid opening archives received from unknown or unverified sources.
Patch Information
No vendor patch or advisory is referenced in the NVD data at the time of publication. Monitor NCH Software release notes for an updated ExpressZip build addressing CVE-2025-44089 and consult the GitHub CVE-2025-44089 Reference for researcher updates.
Workarounds
- Uninstall ExpressZip v11.29 where feasible and use an alternative archive utility until a fix is released.
- Restrict execution of ExpressZip through application control policies (WDAC, AppLocker) on endpoints that do not require it.
- Configure the email gateway to strip or sandbox archive attachments from untrusted senders.
- Enforce least-privilege user accounts so that any successful exploitation is confined to a non-administrative context.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
