CVE-2022-29072

Deeper analysis

7-Zip through version 21.07 on Windows is affected by a local vulnerability that permits command execution when a specially crafted .7z file is dragged onto the Help>Contents menu area inside 7zFM.exe. The root cause is a combination of 7z.dll misconfiguration and a heap overflow (CWE-787), which results in the attacker-supplied command being launched as a child process under the 7-Zip File Manager.

An attacker with the ability to place a malicious archive on a system and convince a user to interact with it via drag-and-drop can achieve arbitrary command execution. The CVSS 7.8 vector reflects local access, low attack complexity, and no privileges required beyond the ability to run 7-Zip, with high impact on confidentiality, integrity, and availability; however, multiple third-party reports indicate that privilege escalation beyond the current user context does not actually occur.

Public proof-of-concept material, including exploit code and demonstration videos, has been available since disclosure. The associated EPSS score has remained in a moderate band (current 0.1889, peak 0.2245) without a pronounced post-disclosure climb, suggesting limited in-the-wild exploitation interest to date.