How severe is CVE-2024-11612?

CVE-2024-11612 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-11612 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-11612?

CVE-2024-11612 affects 7-zip. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-11612?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-11612 have an EU (EUVD) identifier?

Yes. CVE-2024-11612 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-33917.

When was CVE-2024-11612 published?

CVE-2024-11612 was published on 2024-11-22 and last updated on 2026-06-17.

CVE-2024-11612

CVE-2024-11612 is a medium-severity vulnerability in 7-zip with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-835.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 2% (74th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-33917
Weakness: CWE-835
Affected product: 7-zip
Published: 2024-11-22
Last modified: 2026-06-17

Description

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.

Frequently asked questions

What is CVE-2024-11612?: 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.
How severe is CVE-2024-11612?: CVE-2024-11612 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-11612 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-11612?: CVE-2024-11612 affects 7-zip. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-11612?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-11612 have an EU (EUVD) identifier?: Yes. CVE-2024-11612 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-33917.
When was CVE-2024-11612 published?: CVE-2024-11612 was published on 2024-11-22 and last updated on 2026-06-17.

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1606/

Affected products (1)

cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:*

More vulnerabilities in 7-zip

CVE-2008-6536 — Critical (CVSS 10.0): Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the…
CVE-2026-48095 — High (CVSS 8.8): 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow…
CVE-2018-10172 — High (CVSS 8.8): 7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function…
CVE-2016-2335 — High (CVSS 8.8): The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote…
CVE-2025-11002 — High (CVSS 7.8): 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote…
CVE-2025-11001 — High (CVSS 7.8): 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote…

All CVEs affecting 7-zip →

Other CWE-835 (Loop with Unreachable Exit Condition (Infinite Loop)) vulnerabilities

CVE-2026-24816 — Critical (CVSS 10.0): Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis…
CVE-2018-20784 — Critical (CVSS 9.8): In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a…
CVE-2017-12997 — Critical (CVSS 9.8): The LLDP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in…
CVE-2017-12995 — Critical (CVSS 9.8): The DNS parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-domain.c:ns_print().
CVE-2017-12990 — Critical (CVSS 9.8): The ISAKMP parser in tcpdump before 4.9.2 could enter an infinite loop due to bugs in print-isakmp.c, several functions.
CVE-2026-31448 — Critical (CVSS 9.4): In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual…

Browse all CWE-835 (Loop with Unreachable Exit Condition (Infinite Loop)) vulnerabilities →