A worrying vulnerability has been discovered in WinZip that could potentially allow remote attackers to execute arbitrary code on affected systems.
This vulnerability, CVE-2025-1240 with a score of 7.8, was discovered in the Winzip decompression software. This is an Out-Of-Bound Write vulnerability - allowing for writing beyond the program's allocated memory.
The CVE-2025-1240 vulnerability stems from insufficient validation of user-supplied data during parsing of a 7Z file. This can result in writing data beyond the allocated buffer, allowing an attacker to execute malicious code within the context of the WinZip process.
Successful exploitation of this vulnerability requires user interaction, specifically the user must visit the file's website or open a malicious 7z file. This means that an attacker would need to trick a user into opening a crafted 7Z file or visit a compromised website hosting a similar file, such as a phishing email or a malicious ad.
Remote code execution vulnerabilities such as CVE-2025-1240 could allow an attacker to take complete control of a victim’s system, steal sensitive data, install malware, or even use the compromised machine as part of a botnet.
Fortunately, CVE-2025-1240 has been addressed in WinZip version 29.0. Users of older versions are advised to upgrade immediately to protect themselves from cybersecurity risks.
According to Security Online
Posts
0 Comments