Privilege Escalation and Command Execution in 7-Zip on Windows

CVE-2022-29072

Summary

7-Zip versions up to 21.07 on Windows are susceptible to a vulnerability that allows for privilege escalation and command execution. This issue arises when a file with the .7z extension is dragged to the Help>Contents area, triggered by a misconfiguration of the 7z.dll and a heap overflow. The resultant command executes within a child process under the 7zFM.exe process. Although it has been reported by multiple third parties that privilege escalation may not actually occur, the potential for command execution still poses a significant risk to users.

References