WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in WinZip, specifically in the parsing of 7Z files. This issue arises from inadequate validation of user-supplied data, leading to an out-of-bounds write that can overwrite memory. As a result, attackers can execute arbitrary code on the affected system, with the executed code running in the context of the current process. Exploitation requires user interaction, such as opening a malicious 7Z file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

Users can update to WinZip versions 76.8 or later for subscription licenses, or to version 29.0 or later, 28.0.16371 and later, or 27.0.16370 and later for perpetual licenses.