7-Zip CVE-2025-0411: Update to Fix the Mark-of-the-Web Bypass

If you use 7-Zip on Windows, check that the copy you use is version 24.09 or later. Versions before 24.09 could fail to carry Windows’ Mark-of-the-Web from a downloaded archive into files inside a nested archive. That let a crafted file shed an origin warning that Windows and some apps use when deciding how cautiously to handle it.

This guide reflects information public by 14 February 2025. The issue is tracked as CVE-2025-0411. The fix was already available in 7-Zip 24.09; a public advisory followed in January, and researchers described active exploitation in February. This is a source-based explanation, not a Jitsumi reproduction of the exploit.

What Mark-of-the-Web does

Windows can attach a Mark-of-the-Web (MotW) marker to files downloaded from the internet. On an NTFS drive, this origin information is stored in a stream named Zone.Identifier. Windows and applications can use it to apply extra checks. For example, Microsoft documents how MotW affects whether Office blocks macros in files from the internet.

MotW is a security signal, not an antivirus verdict. It does not prove a file is malicious, and it does not make a file safe just because the marker is present.

The problem in CVE-2025-0411 was specific: before version 24.09, 7-Zip File Manager could fail to propagate the Zone.Identifier stream when extracting files from a nested archive. The downloaded outer archive could carry MotW while a file extracted from an archive inside it did not. The file had not become trustworthy; Windows had lost information about where it came from. ZDI’s advisory describes the bypass, and the 7-Zip 24.09 release notes confirm that this exact propagation bug was fixed.

How attackers used the bypass

The issue did not mean that merely having 7-Zip installed infected a PC. The published reports describe attacks that still relied on a person interacting with a malicious file.

On 4 February 2025, Trend Micro described a campaign it said it first observed in September 2024. The campaign targeted Ukrainian organisations with phishing emails and nested archives. Some inner archive names used lookalike characters to resemble a document file. That could persuade someone to open the archive and then run what appeared to be a document but was actually a file capable of launching code. Trend Micro’s analysis explains the observed chain. An earlier NHS England Digital alert also reported active exploitation and warned about spoofed file extensions.

This was evidence of a targeted campaign, not evidence that every 7-Zip user or every downloaded archive was affected. The advisory lists user interaction as necessary. The dangerous step in the reported chain was getting someone to open and run a deceptive file after the archive had been extracted.

Check your version and install the fix

1. Open 7-Zip File Manager from the Start menu.
2. Choose Help → About 7-Zip and read the version number.
3. If it is earlier than 24.09, download the Windows installer from the official 7-Zip download page , choose the build that matches your PC, and install it.
4. Reopen Help → About 7-Zip and confirm the version is 24.09 or later.

The official release history records version 24.09 at the end of November 2024. If your organisation manages software updates, ask IT to update 7-Zip. If you keep a portable copy or more than one installation, check the copy that actually opens your archives.

Until the affected copy is updated, do not use it to extract untrusted nested archives. Do not rely on a familiar file icon or extension to judge what an attachment contains.

If you already opened a suspicious archive

Update 7-Zip now, but remember that the patch protects future extraction; it cannot undo a file you already ran.

If you only downloaded or inspected an outer archive and did not run anything inside it, that alone does not show that your PC was compromised. Do not reopen a file that looks suspicious. On a work or school PC, contact IT and follow its incident process before deleting the archive.

If you ran a script or program extracted from an archive while using a version earlier than 24.09, treat it as a possible security incident. Tell your IT team, or get help from a trusted support provider for a personal PC. A later version closes this particular bypass; it cannot establish what an earlier file did.

Sources and scope

The article uses material available by 14 February 2025: the ZDI advisory dated 19 January , the NHS England Digital alert dated 27 January , Trend Micro’s 4 February campaign analysis , the 7-Zip 24.09 release notes , and Microsoft’s Mark-of-the-Web documentation .