CVE-2024-11477

Summary

CVE-2024-11477 is a remote code execution vulnerability affecting 7-Zip's Zstandard Decompression feature. The flaw stems from insufficient validation of user-supplied data, leading to an integer underflow during memory writing. This can enable attackers to execute arbitrary code on affected systems. The vulnerability, discovered and reported as ZDI-CAN-24346, can be exploited through interactions with the library, and the exact attack vector may vary depending on specific implementations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.