CVE-2023-31102
Published: 03 November 2023
Summary
CVE-2023-31102 is a high-severity Wrap or Wraparound (CWE-191) vulnerability in 7-Zip 7-Zip. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-31102 is an integer underflow leading to an invalid read in Ppmd7.c within 7-Zip versions prior to 23.00. The flaw is triggered when the application processes a specially crafted 7Z archive that supplies malformed PPMd data, allowing out-of-bounds memory access during decompression.
An attacker can exploit the issue by supplying a malicious archive to a local victim. Successful exploitation requires the victim to open the archive with an affected 7-Zip build; once triggered, the vulnerability permits arbitrary code execution or information disclosure with high impact to confidentiality, integrity, and availability.
Vendor and third-party advisories recommend immediate upgrade to 7-Zip 23.00 or later, available from the official download site. NetApp and Zero Day Initiative entries confirm that the fix eliminates the underflow condition in the PPMd decoder and advise applying the update across all installations that handle untrusted archives.
The associated EPSS score has reached 0.5468 without a documented low-to-high trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-35429
Vulnerability details
Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.