New 7-Zip Vulnerability – Weaponized RAR5 Files Can Crash Your System

A new vulnerability has been discovered in 7-Zip, one of the world’s most widely used file archiving utilities. Tracked as CVE-2025-53816, this flaw affects all versions prior to v25.00 and allows attackers to craft malicious RAR5 archive files that can trigger heap memory corruption and crash the application.

Technical Insight

The issue originates from a heap-based buffer overflow in 7-Zip’s RAR5 decoder (NCompress::NRar5::CDecoder). When recovering corrupted archive data, a miscalculation during memory zeroing allows attackers to write beyond the allocated heap buffer, potentially corrupting adjacent memory regions. Proof-of-concept tests have shown writes of up to 9,469 bytes beyond intended memory bounds. Given 7-Zip’s widespread use in both personal and enterprise settings, this vulnerability could disrupt workflows and automated systems that handle untrusted archives.

Why It Matters

• 7-Zip has a massive global footprint in both personal and enterprise environments.

• Archive files are the primary delivery method for malware (39% of cases).

• While this bug is unlikely to enable remote code execution, it provides attackers with a stable method to disrupt workflows, automated processes, and business services.

Recommendations

•Upgrade Immediately: Users must update to 7-Zip version 25.00 or later . Manual installation is required as automatic updates are not supported.

•Restrict & Validate Archives: Organizations should limit access to untrusted RAR5 archives and validate files before processing.

•Monitor Systems: Implement monitoring to detect unexpected crashes or abnormal archive-handling behavior.