Security readout for executives and security teams
Plain-English summary
7-Zip before 24.01, specifically 7zz handling NTFS filesystem images, can read past a buffer and expose adjacent bytes as part of a listed filename. The clearest business risk is in services that accept untrusted uploads and extract or inspect them server-side, where this can cause information exposure and service disruption.
Executive priority
Treat as high priority for internet-facing upload or extraction services, because exploitation requires no authentication or user interaction in the CVSS model. For endpoints that do not process untrusted NTFS images, urgency is lower but still warrants normal patch management.
Technical view
CVE-2023-52169 is a CWE-125 out-of-bounds read in NtfsHandler.cpp in 7-Zip before 24.01 for 7zz. The over-read bytes are returned in filename output while listing a filesystem image. CVSS 3.1 is 8.2: network reachable, low complexity, no privileges or user interaction, low confidentiality impact, high availability impact.
Likely exposure
Exposure is most likely where 7zz or 7-Zip before 24.01 processes attacker-supplied NTFS filesystem images, especially web services that accept uploads and extract or list archive/image contents server-side. The provided affected-product metadata is incomplete, so confirm actual packaged versions in your environment.
Exploitation context
The source bundle does not cite active exploitation, and KEV is false. The vulnerability matters when an attacker can cause a vulnerable server-side 7-Zip process to inspect a crafted NTFS image. Public sources describe the issue class and use case risk, but the bundle does not provide exploit telemetry.
Researcher notes
The precise affected downstream products are not identified in the CVE affected block. Focus validation on the 7zz NTFS handler path and file-listing behavior, not generic archive handling. Do not assume exploitation in the wild without separate telemetry or KEV listing.
Mitigation direction
- Upgrade 7-Zip or 7zz to version 24.01 or later.
- Identify services that process untrusted uploads with 7-Zip.
- Avoid server-side extraction of untrusted filesystem images where unnecessary.
- Run extraction in isolated, least-privilege workers with resource limits.
- Check vendor advisories for downstream product-specific fixes.
Validation and detection
- Inventory installed 7-Zip and 7zz versions across servers and containers.
- Review upload pipelines for NTFS filesystem image processing.
- Confirm vulnerable versions are not reachable from public upload paths.
- Check logs for crashes or abnormal filename output during extraction.
- Track vendor advisories for appliances or products bundling 7-Zip.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-52169 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H3.94.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://sourceforge.net/p/sevenzip/bugs/2402/CVE reference
- https://www.openwall.com/lists/oss-security/2024/07/03/10CVE reference
- https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/CVE reference
- https://security.netapp.com/advisory/ntap-20241122-0011/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.