Skip to content
Fencer Vulns
high 7.8

CVE-2024-11477 in the critical feed json

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

published 2024-11-22 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-34129

cvss
7.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
22.4%
EPSS 22.4% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of Zstandard decompression. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24346.

Patch / fix

  • 7-zip 7zip 24.07
  • 7zip Debian 14, Debian 13 24.07+dfsg-1

debian advisories DEBIAN-CVE-2024-11477

  • libqt5-qtwebengine openSUSE Tumbleweed 5.15.19-1.1

opensuse advisories openSUSE-SU-2025:15531-1

  • qt5-qtwebengine Alpine 3.21 5.15.17-r7
  • qt5-qtwebengine Alpine 3.23, Alpine 3.22 5.15.17-r10
  • qt6-qtwebengine Alpine 3.24, Alpine 3.23, Alpine 3.22 6.8.2-r3

alpine advisories ALPINE-CVE-2024-11477

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-184-03 updated cvss 8.2

Mitsubishi Electric MELSOFT Update Manager (Update B)

  • Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-M >=1.000A, <=1.012N
    affected: vendor fix, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction

22.39% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • 7-Zip 7-Zip
  • 7-zip 7zip

Classification

Weakness
  • CWE-191 Integer Underflow (Wrap or Wraparound)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.