Vulnerability · Published Jul 17, 2025 · Assigned by GitHub_M
CVE-2025-53817GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream
Medium 5.5
In plain English
A medium-severity null pointer dereference in 7-Zip from ipavlov. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.5Medium
Exploit odds (30 days)0.7%top 46.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | 7zip | 22.01+really25.01+dfsg-0+deb12u1 | DEBIAN-CVE-2025-53817 |
| Debian:13 | 7zip | 25.00+dfsg-1 | DEBIAN-CVE-2025-53817 |
| Debian:14 | 7zip | 25.00+dfsg-1 | DEBIAN-CVE-2025-53817 |
| Debian:12 | p7zip | 16.02+really25.01+dfsg-0+deb12u1 | DEBIAN-CVE-2025-53817 |
| Debian:13 | p7zip | 16.02+transitional.1 | DEBIAN-CVE-2025-53817 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P