Cyber Resilience

CVE-2024-11612

MediumDDoS

Published: 22 November 2024

Published
22 November 2024
Modified
07 August 2025
KEV Added
—
Patch
—
CVSS Score v3 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score 0.0175 83.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-11612 is a medium-severity Infinite Loop (CWE-835) vulnerability in 7-Zip 7-Zip. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 17.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.…

more

The specific flaw exists within the processing of streams. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-24307.

CWE(s)
CWE-835

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

7-zip
7-zip
24.06 — 24.08

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-7 Alternate Processing Site
addresses: CWE-835

Enables transfer to alternate site if an infinite loop at the primary renders processing unavailable.

SC-5 Denial-of-service Protection
addresses: CWE-835

Detects and mitigates infinite loops that produce sustained resource consumption.

References