Security readout for executives and security teams
Plain-English summary
This CVE concerns a 7-Zip Windows setting that can grant a powerful memory-related Windows privilege to a user account. The reported business risk is weakened isolation for sandboxed processes. The issue is explicitly disputed, severity is not scored, and the provided sources do not show active exploitation.
Executive priority
Treat this as a targeted configuration and exposure review, not an emergency. Prioritize systems handling untrusted archives or sandboxed workloads, and track vendor guidance because the vulnerability status is disputed and severity is unknown.
Technical view
7-Zip through 18.01 on Windows reportedly uses LsaAddAccountRights for the “Large memory pages” option to add SeLockMemoryPrivilege to the user account. The concern is that sandboxed processes running in that user context may inherit a privilege that helps bypass intended restrictions. Third parties dispute whether this is a vulnerability.
Likely exposure
Likely exposure is limited to Windows systems running 7-Zip through 18.01 where the Large memory pages option has been used or configured. The CVE data provides no CPEs, no scored severity, and no broader affected-product list.
Exploitation context
The source bundle does not cite known exploitation, and the CVE is not marked as CISA KEV. The exploitation concern is contextual privilege availability inside sandboxed processes, not a published remote attack path in the provided evidence.
Researcher notes
The key research question is whether SeLockMemoryPrivilege assignment materially changes sandbox escape or restriction-bypass outcomes in a specific environment. The public record is sparse, disputed, and does not provide CVSS, CWE, CPE, exploit evidence, or a named fix.
Mitigation direction
- Check current 7-Zip vendor guidance and release notes before choosing a remediation path.
- Avoid enabling Large memory pages unless there is a documented operational need.
- Review accounts granted SeLockMemoryPrivilege on Windows endpoints using 7-Zip.
- Prefer supported, current 7-Zip versions where operationally feasible.
Validation and detection
- Inventory Windows endpoints for 7-Zip versions through 18.01.
- Check whether affected users have SeLockMemoryPrivilege assigned.
- Review configuration history for use of the Large memory pages option.
- Confirm whether sandboxed workflows run under accounts granted this privilege.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10172 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.