A newly disclosed high-severity vulnerability in WinZip, tracked as CVE-2025-1240, enables remote attackers to execute arbitrary code on affected systems by exploiting malformed 7Z archive files. Security firm Zero Day Initiative (ZDI) detailed the flaw as ZDI-CAN-24986, noting its potential for widespread abuse given WinZip’s global user base. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The flaw, rated 7.8 on the CVSS scale, impacts WinZip 28.0 (Build 16022) and earlier versions, requiring users to update to WinZip 29.0 to mitigate risks. The vulnerability arises from inadequate validation of 7Z file data during parsing, permitting attackers to create malicious archives that cause an out-of-bounds write in memory. Security analysts urge organizations to prioritize updating affected software and educate users on recognizing suspicious file attachments. While the attack requires user interaction, the prevalence of 7Z files in software distribution and data sharing increases the likelihood of successful phishing campaigns. This corruption can be leveraged to execute code within the context of the WinZip process, potentially enabling full system compromise if paired with additional exploits. This vulnerability follows a surge in file-parsing exploits, including a recent Windows OLE zero-click flaw (CVE-2025-21298) that allowed RCE via malicious emails. Palo Alto Networks has released a patch for a high-severity authentication bypass vulnerability, identified as CVE-2025-0108, affecting their PAN-OS software. WinZip Computing addressed the flaw in version 29.0 (Build 16250), released in December 2024. Such incidents underscore the importance of proactive patch management, particularly for widely used utilities like WinZip, which handles over 1 billion compressed files annually. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Feb 2025 03:20:18 +0000