CVE-2025-0411: 7-Zip archive extraction fails to propagate Mark-of-the-Web

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with active exploitation and a very high EPSS score, but exploitation requires user interaction and a local vector, so it is not critical.

What it is

7-Zip does not propagate the Mark-of-the-Web (MOTW) to files extracted from a crafted archive that itself carries MOTW. Because MOTW is what triggers Windows protections such as SmartScreen and Office macro blocking, extracted files lose those defenses. The flaw is remotely reachable via a malicious page or archive and is listed in CISA KEV, so it is being exploited in the wild.

Impact

An attacker can get code to run in the context of the current user by convincing the victim to open a crafted archive and then run an extracted file, since the extracted file no longer carries the MOTW warning. This enables initial access and follow-on payload execution without the usual Windows security prompts.

Attack surface

Reached locally: the victim must visit a malicious page or open a malicious archive, and user interaction is required (CVSS UI:R, AV:L). No authentication is needed (PR:N), but the attacker must first deliver the archive to the target.

Exploitation

CVE-2025-0411 was added to CISA KEV on 2025-02-06 with a 2025-02-27 remediation due date, and EPSS shows a 30-day probability of 0.671 (99.3rd percentile). No ransomware campaign use is documented in the record.

What to do

• Update 7-Zip to a version that propagates Mark-of-the-Web on extraction; apply the vendor fix as the first action.
• For NetApp Active IQ Unified Manager, apply the NetApp advisory ntap-20250207-0005 guidance or discontinue use if no fix is available.
• Until patched, block or restrict archive attachments and downloads from untrusted sources at the email and web gateway.
• Enforce Windows Attachment Manager and SmartScreen policies, and consider disabling or restricting macro execution from downloaded files.
• Track CISA KEV remediation deadlines and verify the fix is deployed across all endpoints and servers running 7-Zip.

Detection

• Monitor for archive files written to disk with MOTW (Zone.Identifier) followed by extraction and immediate execution of the extracted file.
• Alert on child processes spawned by 7-Zip or other archive tools that then launch executables or scripts from user download or temp directories.
• Hunt for files extracted from internet-sourced archives that lack a Zone.Identifier stream despite originating from a download.
• Correlate browser or email download events with subsequent archive extraction and process creation on the same host within a short window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.