Editing 7-Zip (section)

==Security==
On older versions, self-extracting archives were vulnerable to [[arbitrary code execution]] through [[DLL hijacking]]: they load and run a DLL named UXTheme.dll, if it is in the same folder as the executable file.<ref>{{cite web|last1=Kanthak|first1=Stefan|title=Executable installers are vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege|url=http://seclists.org/fulldisclosure/2015/Dec/34|website=SecLists.org|date=8 December 2015}}</ref><ref>{{cite web|last1=Kanthak|first1=Stefan|title=Executable installers are vulnerable^WEVIL (case 14): Rapid7's ScanNowUPnP.exe allows arbitrary (remote) code execution|url=http://seclists.org/fulldisclosure/2015/Dec/90|website=SecLists.org|date=22 December 2015}}</ref><ref>{{cite web|last1=Hart|first1=Jon|title=ScanNow DLL Search Order Hijacking Vulnerability and Deprecation|url=https://community.rapid7.com/community/infosec/blog/2015/12/21/scannow-dll-search-order-hijacking-vulnerability-and-deprecation|website=Rapid7.com|date=21 December 2015}}</ref> 7-Zip 16.03 Release notes say that the installer and SFX modules have added protection against DLL preloading attack.<ref name="7zipHistory" />

Versions of 7-Zip prior to 18.05 contain an [[arbitrary code execution]] vulnerability in the module for extracting files from [[RAR (file format)|RAR archives]] ({{CVE|2018-10115}}), a vulnerability that was fixed on 30 April 2018.<ref>{{cite web|url=https://www.cisecurity.org/advisory/a-vulnerability-in-7-zip-could-allow-for-arbitrary-code-execution_2018-049/|title=A Vulnerability in 7-Zip Could Allow for Arbitrary Code Execution|website=cisecurity.org|date=2018-05-01}}</ref>

Versions prior to 23.0 also contained an [[arbitrary code execution]] vulnerability, fixed on 7 May 2023.<ref>{{cite web|url=https://www.zerodayinitiative.com/advisories/ZDI-23-1165|title=7-Zip 7Z File Parsing Integer Underflow Remote Code Execution Vulnerability|website=zerodayinitiative.com|date=2022-08-23}}</ref> A year later, a severe [[remote code execution]] vulnerability was found on versions prior to 24.07 ({{CVE|2024-11477}}), it was fixed on 20 November 2024.<ref>{{cite web |title=7-Zip RCE Vulnerability Let Attackers Execute Remote Code |url=https://gbhackers.com/7-zip-vulnerability/ |website=GBHackers Security {{!}} #1 Globally Trusted Cyber Security News Platform |access-date=26 November 2024 |date=25 November 2024}}</ref>