7-Zip CVE-2025-0411 (ZDI-25-045) is a Mark-of-the-Web bypass in 7-Zip before 24.09: files opened from a crafted archive nested inside another archive lose the Windows “downloaded from the internet” marker, so the usual security warning never appears. Fix it by installing the current 7-Zip release (26.03), removing every older copy, and rescanning.
What the scanner is actually detecting
Tenable ships two version checks for this family of bugs, and a host that was patched to 24.09 in early 2025 can still trip the second one.
| Scanner | Finding | What it means |
|---|---|---|
| Nessus | 7-Zip < 24.09 (ZDI-25-045), plugin 214542 | CVE-2025-0411. Flags any 7-Zip install on Windows older than 24.09. |
| Nessus | 7-Zip <= 26.01 Mark-of-the-Web Bypass (CVE-2026-58052), plugin 324932 | A newer MotW bypass through crafted RAR5 stream records. Flags 26.01 and earlier. |
Both are Windows local checks built on Tenable’s 7-Zip install detection, so they need a credentialed scan or a Nessus Agent. Tenable states for both that Nessus did not test the flaw and relied only on the application’s self-reported version number.
There is one gap to know about. Plugin 324932 stops at 26.01, the GitHub advisory for CVE-2026-58052 lists 7-Zip for Windows as affected through 26.02, and the official 7-Zip change log records the fix in 26.03 (released 2026-09-03). A host on 26.02 can look clean in the report and still be affected, so make 26.03 or later your target.
Real-world risk
Windows tags files downloaded from the internet with a Zone.Identifier alternate data stream, the Mark-of-the-Web (MotW). SmartScreen and other Windows protections read it before a downloaded file runs. Since version 22.00, 7-Zip can copy that stream from an archive to the files it extracts. The 24.09 change log describes the bug plainly: 7-Zip File Manager did not propagate the Zone.Identifier stream for files extracted from nested archives (an archive opened inside another open archive). An attacker sends a double-wrapped archive, the user opens it in 7-Zip and double-clicks the inner file, and it runs without the internet-zone warning, with the user’s rights.
Keep the limits in view. ZDI and Tenable score it CVSS 7.0 with a local attack vector, high attack complexity and required user interaction. It is not remotely exploitable on its own and does not elevate privileges. What moves it up the queue is evidence of use: CISA added CVE-2025-0411 to the Known Exploited Vulnerabilities catalog on 2025-02-06 with a 2025-02-27 due date for federal agencies (see how the CISA KEV catalog works), and Tenable lists a public exploit as available. Treat it as a phishing enabler on any machine where people open email attachments or web downloads.
CVE-2026-58052 is lower impact. Tenable scores it CVSS 3.3 (integrity only), and it was not in the KEV catalog at the time of writing.
One setting shapes your exposure. When a user double-clicks a single file inside an archive, 7-Zip File Manager copies the archive’s MotW to the temporary file regardless of settings; that is the path CVE-2025-0411 broke. Ordinary Extract commands instead follow Tools > Options > 7-Zip > Propagate Zone.Id stream, and in the 7-Zip source code an unset value is treated as No. Patching fixes the bug, but bulk-extracted files keep MotW only if that option is on.
How to confirm it on the host
List registered installs, including 32-bit copies on 64-bit Windows (run in PowerShell):
Get-ItemProperty 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionUninstall*',
'HKLM:SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall*',
'HKCU:SoftwareMicrosoftWindowsCurrentVersionUninstall*' -ErrorAction SilentlyContinue |
Where-Object DisplayName -like '7-Zip*' |
Select-Object DisplayName, DisplayVersion, InstallLocation, PSChildNameThe EXE installer registers under a key named 7-Zip. The MSI registers under a product code GUID, and the 64-bit MSI adds “(x64 edition)” to the name. Seeing both on one host means two installs.
Read the binaries directly, then look for portable copies that never appear in the registry:
'C:Program Files7-Zip7zFM.exe','C:Program Files (x86)7-Zip7zFM.exe' |
Where-Object { Test-Path $_ } |
ForEach-Object { '{0} {1}' -f $_, (Get-Item $_).VersionInfo.ProductVersion }
Get-ChildItem -Path C: -Recurse -Force -ErrorAction SilentlyContinue -Include 7zFM.exe,7z.exe,7zG.exe |
Select-Object FullName, @{n='Version';e={$_.VersionInfo.ProductVersion}}Where winget is available, winget list --id 7zip.7zip --exact shows the installed and available versions. To see a user’s propagation setting:
reg query "HKCUSoftware7-ZipOptions" /v WriteZoneIdExtractHow to fix it
Pick the target version
7-Zip 24.09 closes CVE-2025-0411, but later releases fixed more: symbolic link extraction flaws (25.00 and 25.01), memory-safety bugs in several archive handlers (26.01), an XZ decompression heap overflow listed as remote code execution (26.02) and CVE-2026-58052 (26.03). Deploy the newest release, which is 26.03 at the time of writing. 7-Zip has no built-in updater, so every copy has to be pushed. Roll it out in rings (pilot group, then broad) as you would any ring-based patch deployment.
Single machines or scripted updates: winget
From an elevated prompt (the package installs machine-wide):
winget upgrade --id 7zip.7zip --exact --silent --accept-package-agreements --accept-source-agreementswinget only updates what it recognizes as the 7zip.7zip package. It will not touch portable copies or a second architecture.
Fleet deployment with the MSI
The official download page offers 7z2603-x64.msi (64-bit) and 7z2603.msi (32-bit). The 7-Zip FAQ documents this silent install syntax:
msiexec /i 7z2603-x64.msi /q INSTALLDIR="C:Program Files7-Zip"Package that as an Intune line-of-business or Win32 app, a Configuration Manager application, or a GPO assignment under Computer Configuration > Policies > Software Settings > Software installation. The MSI performs a major upgrade of older MSI installs of the same architecture. It does not remove an EXE-based install or the other architecture, because the 32-bit and 64-bit MSIs use different upgrade codes.
EXE installer
Per the 7-Zip FAQ, the switches are case-sensitive:
7z2603-x64.exe /S /D="C:Program Files7-Zip"If a file such as the Explorer context-menu DLL is in use, the installer schedules its replacement for the next restart, and in silent mode it does not prompt. Reboot before you rescan.
Remove old 32-bit, 64-bit and portable copies
Standardize on one architecture and one installer type. Both builds register the same Explorer context-menu handler ID, so remove the copy you are not keeping first, then install. For an EXE-based install, use its silent uninstaller (the same command the installer writes to QuietUninstallString):
& 'C:Program Files (x86)7-ZipUninstall.exe' /SFor an MSI-based install, take the product code from the PSChildName column of the inventory command:
msiexec /x {PRODUCT-CODE-GUID} /qnDelete or replace portable 7zFM.exe copies found by the file search, including those in tool shares and user download folders.
Turn on Zone.Id propagation
To make extracted files keep MotW, set Propagate Zone.Id stream to Yes. It is a per-user value, WriteZoneIdExtract (DWORD) under HKCUSoftware7-ZipOptions, where 0 is No, 1 is Yes and 2 is For Office files:
reg add "HKCUSoftware7-ZipOptions" /v WriteZoneIdExtract /t REG_DWORD /d 1 /fAt scale, push it as a Group Policy Preferences registry item under User Configuration > Preferences > Windows Settings > Registry. For command-line jobs the equivalent is the -snz switch.
Or remove 7-Zip where nobody needs it
If users on a host only open ZIP files, File Explorer’s built-in archive support may be enough. Uninstalling 7-Zip closes both findings for good and leaves one less application to patch by hand.
How to verify the fix and rescan
- Reboot if the EXE installer ran while 7-Zip or Explorer had files open.
- Rerun the inventory and file-version commands. Every entry should show 26.03 or later, with one architecture and no portable leftovers.
- Check propagation on a test file: download an archive from the internet, extract it with 7-Zip, and run
Get-Content -Path .extractedfile.txt -Stream Zone.Identifier. With the option set to Yes you should seeZoneId=3(Internet). - Rescan with a credentialed Windows policy or a Nessus Agent. Plugins 214542 and 324932 should no longer report the host.
What can break and how to roll back
- Compression defaults: 24.09 raised the default LZMA/LZMA2 dictionary sizes (for 64-bit Ultra, from 64 MB to 256 MB). Archives created by scripts at high levels may need more memory to extract on older or 32-bit systems. Set the dictionary size explicitly in jobs where that matters.
- Symbolic links: 25.00 and 25.01 tightened symbolic link handling during extraction. Jobs that rely on archives creating links can fail; the change log documents
-snld20to bypass the new checks, which you should treat as a documented exception. - MotW side effects: once propagation is on, extracted Office files and scripts carry the internet marker, so users will see warnings they did not see before. That is the intended result, but tell the helpdesk.
- Mixed installers: installing the MSI over an EXE-based install leaves two registrations. Uninstall the EXE version first.
To roll back, uninstall the new version and reinstall the previous build from the 7-Zip download archive. Anything below 24.09 brings back a KEV-listed vulnerability, so rolling forward to a fixed release is almost always the better option.
Common false positive reasons
- A second install: the 64-bit copy was updated but a 32-bit or per-user copy remains. The finding is accurate.
- Pending reboot: the installer staged files for replacement and the host was scanned before restarting.
- Leftover registrations: a folder deleted by hand instead of uninstalled can leave an uninstall entry with an old version. Check that
InstallLocationstill exists and clean it up properly. - “Nobody uses the File Manager”: the check is version-based and does not claim to test exploitability. Low practical risk on a server is a reason to prioritize, not to suppress.
FAQ
Is 7-Zip 24.09 enough to close the finding?
It closes plugin 214542, but plugin 324932 and later 7-Zip security fixes apply to newer versions. Install 26.03 or later.
Does 7-Zip update itself?
No. It has no automatic updater, so central deployment through winget, Intune, Configuration Manager or GPO is the only reliable path.
Are Linux or macOS builds affected?
Mark-of-the-Web is a Windows mechanism, and both plugins are Windows-only checks. The Linux builds are not part of this finding.
Why do extracted files still lack MotW after patching?
Because Propagate Zone.Id stream is not set to Yes for that user. The patch fixes the nested-archive bug; the option controls whether normal extraction copies MotW at all.
Tracking this finding across many hosts
Across a large Windows fleet, the work is finding every stray copy and proving each one is gone. SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners (Nessus results arrive as uploaded .nessus exports) and merges duplicates per scanner. Its AI-written, host-specific remediation scripts pass human approval gates before its agents deploy them on Windows and Linux endpoints, and Nessus findings can be retested individually to confirm closure.