Heap-based buffer overflow vulnerability in 7-Zip's NtfsHandler.cpp

CVE-2023-52168

What is CVE-2023-52168?

In versions of 7-Zip prior to 24.01, an issue exists within the NTFS handler (NtfsHandler.cpp) that exposes a heap-based buffer overflow vulnerability. This flaw enables attackers to overwrite memory at specific offsets beyond the allocated buffer size, specifically targeting addresses at buffer+512*i-2 for multiple values of i (i.e., 9, 10, 11, etc.). Such vulnerabilities can lead to unauthorized access and manipulation of data, underscoring the importance of updating to the latest version to mitigate potential risks. Users are urged to review their current installations and apply necessary security patches.

References