CVE-2025-53817: 7-Zip Compound Handler DoS Vulnerability

CVE-2025-53817 Overview

CVE-2025-53817 is a null pointer dereference vulnerability affecting 7-Zip, a widely-used file archiver with high compression ratio capabilities. The vulnerability exists in the Compound Document handler, which is responsible for extracting content from Microsoft Compound Documents (such as .doc, .xls, and other OLE-based file formats). Prior to version 25.0.0, a maliciously crafted compound document can trigger a null pointer dereference condition, leading to denial of service.

Critical Impact

Attackers can crash 7-Zip processes by providing specially crafted compound documents, causing denial of service conditions that disrupt file extraction operations and potentially impact automated archive processing workflows.

Affected Products

• 7-Zip versions prior to 25.0.0
• All platforms where 7-Zip's compound document extraction is utilized
• Applications and services integrating 7-Zip libraries for archive processing

Discovery Timeline

• 2025-07-17 - CVE-2025-53817 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-53817

Vulnerability Analysis

This vulnerability falls under CWE-476 (NULL Pointer Dereference), a memory corruption class where a program dereferences a pointer that is expected to be valid but is actually NULL. In the context of 7-Zip's Compound Document handler, the vulnerability occurs during the parsing and extraction process of compound file structures.

Microsoft Compound Documents use a complex internal structure with multiple streams and sectors. When 7-Zip processes these files, the handler must navigate through directory entries and stream references. The vulnerability arises when certain malformed or unexpected compound document structures cause the handler to attempt dereferencing a null pointer, resulting in an immediate crash of the application.

The local attack vector requires an attacker to provide a malicious archive file to the victim, either through direct file transfer, email attachment, or by hosting the file for download. When the victim attempts to extract or preview the archive contents using an affected version of 7-Zip, the null pointer dereference is triggered.

Root Cause

The root cause is improper validation of pointer values before dereferencing within 7-Zip's Compound Document handler. When processing certain compound document structures, the code fails to verify that a pointer is non-null before attempting to access the memory it references. This can occur when parsing corrupted or maliciously crafted compound document directory entries or stream references.

Attack Vector

The attack requires local interaction where a user opens or extracts a specially crafted compound document archive using 7-Zip. The exploitation scenario involves:

1. An attacker creates a malformed compound document file designed to trigger the null pointer condition
2. The malicious file is delivered to the target (via email, file sharing, or other distribution methods)
3. When the victim uses 7-Zip to open, preview, or extract the archive, the null pointer dereference occurs
4. The 7-Zip process crashes, causing denial of service

Since this is a denial of service vulnerability without evidence of code execution capability, the impact is limited to availability rather than confidentiality or integrity. However, in automated processing environments, repeated crashes could disrupt critical workflows.

For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory and the Openwall OSS-Security Notice.

Detection Methods for CVE-2025-53817

Indicators of Compromise

• Unexpected 7-Zip process crashes when handling compound document files
• Application error logs indicating null pointer dereference or access violation exceptions in 7-Zip
• Repeated crashes when processing files from untrusted sources
• Core dump or crash dump files related to 7-Zip operations

Detection Strategies

• Monitor for abnormal termination of 7-Zip processes (exit codes indicating crashes)
• Implement file inspection capabilities to identify potentially malformed compound documents before processing
• Deploy endpoint detection rules to alert on repeated 7-Zip crashes within short time windows
• Review system event logs for application fault events associated with 7z.exe, 7zG.exe, or 7zFM.exe

Monitoring Recommendations

• Enable crash reporting and centralized logging for archive processing systems
• Monitor automated archive extraction pipelines for processing failures
• Implement anomaly detection for unusual patterns in file extraction operations
• Track and alert on multiple 7-Zip process terminations from the same user or system

How to Mitigate CVE-2025-53817

Immediate Actions Required

• Upgrade 7-Zip to version 25.0.0 or later immediately
• Audit all systems and applications utilizing 7-Zip for compound document extraction
• Implement file validation processes before passing archives to 7-Zip for extraction
• Consider sandboxing archive extraction operations to limit denial of service impact
• Alert users to avoid opening archives from untrusted sources until patches are applied

Patch Information

7-Zip version 25.0.0 contains the fix for this null pointer dereference vulnerability. Organizations should update all instances of 7-Zip to version 25.0.0 or newer to remediate this issue. The fix includes proper null pointer validation in the Compound Document handler before dereferencing operations.

For additional details, consult the GitHub Security Advisory for GHSL-2025-059.

Workarounds

• Avoid processing compound document files from untrusted sources with affected 7-Zip versions
• Use alternative archive extraction tools temporarily until upgrade is complete
• Implement process monitoring to automatically restart crashed 7-Zip processes in automated environments
• Deploy file type filtering to quarantine suspicious compound documents for manual review
• Consider using containerized or sandboxed environments for processing untrusted archives

# Verify 7-Zip version (Windows)
"C:\Program Files\7-Zip\7z.exe" --help | findstr "7-Zip"

# Verify 7-Zip version (Linux)
7z --help | grep "7-Zip"

# Update 7-Zip via package manager (Linux distributions)
# Debian/Ubuntu
sudo apt update && sudo apt upgrade p7zip-full

# Fedora/RHEL
sudo dnf update p7zip