Pierluigi Paganini December 31, 2024

An X user using the handle @NSA_Employee39 disclosed a zero-day vulnerability in the open-source file archive software 7-Zip.

A verified X account, @NSA_Employee39, claimed to disclose a zero-day vulnerability in the open-source file archive software 7-Zip.

The X user announced it would be “dropping 0days all this week,” starting with an arbitrary code execution vulnerability in the open-source software 7-Zip.

An attacker could exploit this vulnerability to execute malicious code on victims’ systems by tricking them to open a specially crafted .7z archive.

Hey guys, as a thank you to all the new followers, I will be dropping 0days all this week until MyBB.

Here's a ACE vulnerability in 7zip.https://t.co/FjvDD155Vo

(Can't access GitHb until I get home, sorry lol)

Offsets might need changing, slight modifications based on victim…

— a (@NSA_Employee39) December 30, 2024

The users published the exploit code for this zero-day vulnerability on Pastebin.

“This exploit targets a vulnerability in the LZMA decoder of the 7-Zip software. It uses a crafted .7z archive with a malformed LZMA stream to trigger a buffer overflow condition in the RC_NORM function. By aligning offsets and payloads, the exploit manipulates the internal buffer pointers to execute shellcode which results in arbitrary code execution.” wrote on Pastebin. “When the victim opens/extracts the archive using a vulnerable version (current version) of 7-Zip, the exploit triggers, executing a payload that launches calc.exe (You can change this).“

However, many experts criticized the claim, stating that the exploit does not work and that the zero-day vulnerability does not exist.

The author of 7zip, Igor Pavlov, claims that this vulnerability is fake, he explained that there is no RC_NORM function in LZMA decoder.

“The common conclusion is that this fake exploit code from Twitter was generated by LLM (AI).” wrote Pavlov.

“The comment in the “fake” code contains the statement:

This exploit targets a vulnerability in the LZMA decoder of the 7-Zip software. It uses a crafted .7z archive with a malformed LZMA stream to trigger a buffer overflow condition in the RC_NORM function.”

But there is no RC_NORM function in LZMA decoder.
Instead, 7-Zip contains RC_NORM macro in LZMA encoder and PPMD decoder. Thus, the LZMA decoding code does not call RC_NORM. And the statement about RC_NORM in the exploit comment is not true.“

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, zero-day)