CVE-2025-46652
CVE-2025-46652 is a medium-severity vulnerability with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-830.
Key facts
- Severity: Medium (CVSS 3.x base score 6.1)
- EPSS exploit prediction: 0% (19th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-12481
- Weakness: CWE-830
- Published:
- Last modified:
Description
In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.
Frequently asked questions
- What is CVE-2025-46652?
- In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.
- How severe is CVE-2025-46652?
- CVE-2025-46652 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2025-46652 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-46652?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-46652 have an EU (EUVD) identifier?
- Yes. CVE-2025-46652 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-12481.
- When was CVE-2025-46652 published?
- CVE-2025-46652 was published on 2025-04-26 and last updated on 2026-06-17.
References
- https://github.com/EnisAksu/Argonis/blob/main/CVEs/IZArc/IZArc%20Mark-of-the-Web%20Bypass%20Vulnerability.md
- https://github.com/EnisAksu/Argonis/security/advisories/GHSA-637g-8v47-79mv
- https://www.izarc.org/news
Other CWE-830 vulnerabilities
- CVE-2023-2588 — High (CVSS 8.8): Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed…
- CVE-2025-65109 — High (CVSS 8.5): Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf…
- CVE-2024-29944 — High (CVSS 8.4): An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript…
- CVE-2024-42381 — High (CVSS 8.3): os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows…
- CVE-2025-43703 — Medium (CVSS 6.1): An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access…
- CVE-2025-33028 — Medium (CVSS 6.1): In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.…