⚠️ New 7-Zip Software Exploit Found! - Here's The Fix

C:\Program Files\7-Zip

[benwaffleiron]

i caught this 7 seconds after it was uploaded, i feel powerful

[Ishan.khanna]

My 40 day win rar trial going strong for the 2nd year

[snarkykat]

Wow! I'm glad I caught this video's notification. I'm going to implement the fix you recommend immediately. By the way, happy birthday tomorrow!

[BetaMaster]

we've really reached the point where people are exploiting HELP to get system-breaking bugs

[aerglass]

me using file manager in linux: you have no power

[Leo-sdjt]

You should probably remove this video since the vulnerability ended up being a hoax

[SkyyySi]

I'm guessing this issue comes from some legacy Windows component rather than 7zip itself, since it's very unlikely that 7zip can, by itself, be used to gain system privileges.

[nrg]

Interesting, though a hacker would need access to your system to begin with for it to be useful to them.

[matiinb]

I've been using 7-Zip myself and I've been recommending it to other people. Thank you so much for telling us about such a thing !

[baddealrage]

Thanks for the headups gonna fix this asap.

[strikeshock]

For the people not seeing it show up, it is the file with the yellow questionmark as a logo.
Credits to: Łukasz R.

[PokemarioThend]

Does this only affect certain versions? I have an older version, and, when I checked my 7Zip directory, it didn't have a chm file at all

[sasshadow]

This only effects the latest version of 7zip btw. Older versions are uneffected.

[ksrele]

Am I the only one who don't understand how someone can use this to harm me? I will NEVER drag and drop anything to opened help window. I rarely even open help in any application let alone that I will come to idea to drag and drop something in that window. :)
So, can this exploit be used for other application that uses the same help file mechanism?

[elliejohnson]

I think this is an april fools joke by the original bug reporter. The exploit has been disputed by researchers.

[kyonblack]

@ThioJoe, the CVE is currently being disputed because for the vulnerability to work, you need UAC to be turned off, which is obviously a bad idea and nobody should have it turned off in the first place.

[RaptorZX]

Thanks! And i'm already subscribed, for a long time now.

[hospie]

Joe saving the day as always, thank you king

[agentgrim]

Me on my phone: “You have no power here”

[jendorei]

I researched a bit about the vulnerability and it seems that it won’t affect you unless your computer is already hacked and can be accessed remotely by a malicious actor. The exploit relies on dragging a prepared 7z file into the help menu. Realistically, that wouldn’t affect most people. There’s still no patch after 3 weeks though, which is a bit strange to me.