P7zip (7-zip) - vulnerabilities (CVEs)

6 CVEs, 1 in the last 30 days, 45 known versions, newest CVE from 2026-10-22. Vendor: 7-zip.

CVEs of P7zip

• CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
• CVE-2022-47069 - CVSS 7.8 (high), 2023-08-22: p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at…
• CVE-2018-5996 - CVSS 7.8 (high), 2018-01-31: Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within…
• CVE-2017-17969 - CVSS 7.8 (high), 2018-01-30: Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of…
• CVE-2016-9296 - CVSS 7.5 (high), 2016-11-12: A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in…
• CVE-2015-1038 - CVSS 5.8 (medium), 2015-01-21: p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.