CVE-2025-44090 Overview
CVE-2025-44090 is an arbitrary code execution vulnerability in OhSoft CoffeeZip version 4.8.0.0. The flaw allows attackers to execute arbitrary code when a user downloads and opens a crafted archive file with the vulnerable version of CoffeeZip. Exploitation requires user interaction, specifically the download and execution of a malicious archive.
The vulnerability affects the archive parsing or extraction logic in CoffeeZip, a file compression utility. Public references are available on GitHub, and the vendor distributes updates through the OhSoft Update Download page.
Critical Impact
Successful exploitation results in arbitrary code execution in the context of the user running CoffeeZip, enabling malware installation, credential theft, or lateral movement.
Affected Products
- OhSoft CoffeeZip v4.8.0.0
Discovery Timeline
- 2026-07-22 - CVE-2025-44090 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2025-44090
Vulnerability Analysis
CVE-2025-44090 enables arbitrary code execution through a maliciously crafted archive file processed by OhSoft CoffeeZip v4.8.0.0. The advisory indicates that opening a crafted archive triggers code execution in the CoffeeZip process context. This behavior is consistent with archive parser vulnerabilities such as improper input validation, path traversal during extraction, or memory corruption in decompression routines.
CoffeeZip is a Windows-based archive utility. Vulnerabilities in archive handlers historically allow attackers to bundle payloads inside seemingly benign .zip, .rar, or proprietary archive formats. When the victim opens the archive, the parser mishandles crafted metadata or file entries, leading to attacker-controlled execution.
Root Cause
The published advisory does not disclose the specific weakness class. Public references describe the outcome as arbitrary code execution triggered by parsing a crafted archive. Common root causes for this class of vulnerability include buffer overflows in header parsing, insecure file path handling during extraction, or unsafe deserialization of archive metadata. Refer to the GitHub reference for additional technical detail.
Attack Vector
The attack requires social engineering. An attacker delivers a crafted archive through phishing email, drive-by download, watering-hole hosting, or file-sharing services. When the target downloads the file and opens it with CoffeeZip v4.8.0.0, the malicious payload executes. No network-facing service is exposed by CoffeeZip, so exploitation depends on user interaction.
The vulnerability description references "downloading and executing a crafted archive file," indicating the exploit chain is local to the endpoint but originates from an attacker-controlled file delivered over any channel.
Detection Methods for CVE-2025-44090
Indicators of Compromise
- Unexpected child processes spawned by CoffeeZip.exe such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe.
- Archive files (.zip, .rar, proprietary CoffeeZip formats) with anomalous file sizes, malformed headers, or path traversal sequences.
- New executables, scripts, or scheduled tasks created in user-writable directories shortly after archive extraction.
Detection Strategies
- Monitor process ancestry for CoffeeZip spawning shells, script interpreters, or LOLBins.
- Alert on file writes by CoffeeZip to sensitive paths outside the user-designated extraction directory, which may indicate path traversal exploitation.
- Inspect archives with static analysis tools before opening to identify malformed structures or embedded executables.
Monitoring Recommendations
- Track installations of OhSoft CoffeeZip across the environment and inventory the version, prioritizing v4.8.0.0 for remediation.
- Ingest endpoint process and file telemetry into a centralized SIEM or data lake and build detections around archive utility behavior.
- Correlate email gateway and web proxy logs with endpoint archive extraction events to trace delivery of malicious archives.
How to Mitigate CVE-2025-44090
Immediate Actions Required
- Identify all endpoints running OhSoft CoffeeZip v4.8.0.0 and restrict their ability to open archives from untrusted sources.
- Block or quarantine archive attachments at the email gateway pending verification, especially archives from external senders.
- Advise users to avoid opening archives from unknown sources with CoffeeZip until a patched version is installed.
Patch Information
At the time of publication, the NVD entry does not list a specific fixed version. Check the OhSoft Update Download page for the latest CoffeeZip release and apply any version that supersedes v4.8.0.0. Validate the patch fingerprint before deploying broadly.
Workarounds
- Uninstall CoffeeZip v4.8.0.0 and replace it with an alternative archive utility until a fixed version is available.
- Configure application allow-listing to prevent CoffeeZip from spawning child processes such as command shells or script interpreters.
- Enforce attack surface reduction rules that block child process creation from archive utilities on Windows endpoints.
# Example: Windows Defender ASR rule to block Office/archive apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
