The 7-Zip Zero-Day Claim: What Is Disputed, What Is a Real CVE, and What to Do

Key takeaways

• The NSA_Employee39 LZMA claim is disputed and unconfirmed; the author denied it.
• CVE-2024-11477 is a real, different bug in zstd decompression, fixed in 7-Zip 24.07.
• 7-Zip does not update itself, so check Help, About and update from the official site.
• Judge zero-day claims by CVE records, vendor statements and independent reproduction, not by screenshots.

What actually happened?

In November 2024 a social media account using the name "NSA_Employee39" claimed to have a zero-day remote code execution flaw in 7-Zip's LZMA decoder, and posted a demonstration that opened Windows Calculator. 7-Zip's author, Igor Pavlov, said no such bug existed and that the function named in the claim, RC_NORM, is not in the way the poster described. The poster also hinted at a second zero-day, in the MyBB forum software. Security researchers who looked at the claim did not confirm it, and we are not aware of any confirmed vulnerability matching it. Treat it as an unproven claim.

Do not confuse the disputed claim with CVE-2024-11477. That CVE number belongs to a different, real vulnerability, described next.

What is CVE-2024-11477?

CVE-2024-11477 is a vulnerability in how 7-Zip handled archives compressed with Zstandard (zstd). It is an integer underflow in the zstd decompression code that could lead to code execution when a crafted archive is processed. It was fixed in 7-Zip 24.07, so versions older than that are affected. The CVE was published in late November 2024, around the same time as the social media claim, which is probably why the two were mixed up. Check the record on the National Vulnerability Database for the current description, score and references.

Do not rely on this table alone. Verify against the NVD record and 7-Zip's official release notes before you act on it.

Other real 7-Zip issues worth knowing

• CVE-2025-0411 is a Mark-of-the-Web bypass: files extracted from a downloaded archive did not inherit the "downloaded from the internet" marker, so Windows protections such as SmartScreen did not trigger. It was fixed in 7-Zip 24.09, and was reported to have been used in attacks in the wild. Confirm the details on NVD.
• CVE-2025-53816, covered in our article on the RAR5 crash bug, is a separate issue.

The real lesson: archive tools parse complex, untrusted formats, so bugs in them appear regularly. Having an up-to-date version matters far more than any one headline.

Why does an archive bug matter so much?

• People open archives from email, downloads and chat all day.
• Servers and security tools often extract archives automatically, for example in mail gateways or upload processors, without a person looking.
• Attackers use password-protected archives to avoid scanners. A bug that runs code on extraction removes the need for the victim to run a file.
• 7-Zip does not update itself. Many systems run versions that are years old.

What should you do?

1. Check your version. Open 7-Zip, choose Help, then About. If it is older than 24.07, update now. Newer fixes exist, so move to the current release from the official 7-Zip site, 7-zip.org, and avoid copies from third-party download sites.
2. Inventory it. Organisations should find every copy of 7-Zip, including ones bundled inside other software, using endpoint management or a software inventory tool, and update them through patch management.
3. Consider Mark-of-the-Web handling. Recent 7-Zip versions have an option to propagate the zone marker to extracted files (look for "Propagate Zone.Id stream" in Tools, then Options). Check the documentation for your version and test it.
4. Do not auto-extract untrusted archives. Where a service must process uploads, run extraction in a sandbox or container with limited rights and no network.
5. Scan and block. Use mail and endpoint scanning, and block archive types you do not need.
6. Train users not to open unexpected archives, even from known contacts, and to use the official source for tools.

How to judge a "zero-day" claim on social media

When a headline says "zero-day", slow down and ask:

1. Is there a CVE, advisory or vendor statement? Look it up in NVD or the vendor's security page.
2. Has the vendor responded? A flat denial from the maintainer is evidence, though not proof.
3. Is there a reproducible proof of concept that independent researchers confirmed? A demo video alone can be staged.
4. Who benefits from the claim? Anonymous accounts seeking attention or selling something deserve caution.
5. Is it a zero-day at all? A zero-day is a flaw exploited or known before a fix exists. A fixed, disclosed bug is not a zero-day.

Do not run proof-of-concept code from social media on your own systems. Analyse such samples only in an isolated lab.

Next steps

If you want to learn how vulnerabilities are tracked, scored and tested properly, WebAsha's VAPT course covers vulnerability assessment from scanning to reporting. For a related archive bug, see CVE-2025-53816 in 7-Zip, and for another example of a file-handling flaw, the Vim zip.vim path traversal bug.

Related reading

• Oracle Cloud Data Breach Claim: What Is Confirmed, What Is Disputed and What to Do
• Microsoft December 2024 Patch Tuesday | Key Highlights and Fixes
• What Are the Top Automated Malware Analysis Tools for Cybersecurity Professionals? The Detailed Guide