KLA12514 PE vulnerability in 7-Zip

Privilege escalation vulnerability was found in 7-Zip. Malicious users can exploit this vulnerability to gain privileges and execute arbitrary code by dragging and dropping file with the .7z extension to the Help>Contents area.The vulnerability announced in version 21.07 and disputed by vendor.

Original advisories

CVE-2022-29072

CVE-2022-29072 on GitHub

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

7-Zip

CVE list

CVE-2022-29072 critical

Solution

Update 7-Zip to the latest version when а new patch will be available

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• 7-Zip 21.07 and earlier