PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-0411 7-Zip CVE debrief

CVE-2025-0411 is a 7-Zip Mark of the Web (MOTW) bypass that CISA added to the Known Exploited Vulnerabilities catalog on 2025-02-06. Because CISA has set a mitigation due date of 2025-02-27, organizations should treat affected 7-Zip deployments as an urgent patch and mitigation priority.

Vendor
7-Zip
Product
7-Zip
CVSS
HIGH 7.5
CISA KEV
Listed
Original CVE published
2025-02-06
Original CVE updated
2025-02-06
Advisory published
2025-02-06
Advisory updated
2025-02-06

Who should care

Windows administrators, endpoint security teams, and organizations that rely on 7-Zip to open downloaded or externally sourced archives should prioritize this issue.

Technical summary

The vulnerability is described as a bypass of Windows Mark of the Web handling in 7-Zip. In practical terms, that can weaken security checks and warning flows that depend on downloaded-file trust metadata, especially in workflows that process untrusted archives.

Defensive priority

Urgent — KEV-listed with a 2025-02-27 due date.

Recommended defensive actions

  • Apply the vendor-recommended mitigation or upgrade to a fixed 7-Zip release as soon as it is available.
  • Track and meet the CISA KEV due date of 2025-02-27 for all affected systems.
  • If mitigation cannot be applied promptly, restrict or discontinue 7-Zip use on systems that handle untrusted archives.
  • Review workflows that depend on Windows Mark of the Web warnings or controls and add compensating safeguards where possible.

Evidence notes

CISA KEV metadata identifies CVE-2025-0411 as a 7-Zip Mark of the Web bypass, added on 2025-02-06 with a due date of 2025-02-27 and guidance to apply vendor mitigations or discontinue use if mitigations are unavailable. The supplied record also points to NVD and the 7-Zip release history as follow-up references.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-0411 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-0411

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-0411 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-0411

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.