Vulnerability · Published Jul 17, 2025 · Assigned by GitHub_M
CVE-2025-53816GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder
Medium 5.5
In plain English
A medium-severity heap buffer overflow in 7-Zip from ipavlov. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.5Medium
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | 7zip-rar | 25.00+ds-1 | DEBIAN-CVE-2025-53816 |
| Debian:14 | 7zip-rar | 25.00+ds-1 | DEBIAN-CVE-2025-53816 |
| Debian:12 | p7zip-rar | 16.02+really25.00+ds-0+deb12u1 | DEBIAN-CVE-2025-53816 |
| Debian:13 | p7zip-rar | 16.02+transitional.1 | DEBIAN-CVE-2025-53816 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P