CVE search · CVE-2023-31102

CVE-2023-31102

high 7.8

Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

Open in the NVD CVE.org JSON

Status: Modified
Published: 2023-11-03
Last changed: 2026-06-17
Source: cve@mitre.org
Weakness: CWE-191

Severity

Version	Score	Vector	Source
CVSS 3.1	high 7.8	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`	nvd@nist.govPrimary
CVSS 3.1	high 7.8	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

7-zip · 7-zip
netapp · active_iq_unified_manager
netapp · oncommand_workflow_automation

References

https://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102/
https://security.netapp.com/advisory/ntap-20231110-0007/Third Party Advisory
https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/Issue TrackingRelease Notes
https://www.7-zip.org/download.htmlProduct
https://www.zerodayinitiative.com/advisories/ZDI-23-1165/Third Party AdvisoryVDB Entry
https://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102/
https://security.netapp.com/advisory/ntap-20231110-0007/Third Party Advisory
https://sourceforge.net/p/sevenzip/discussion/45797/thread/713c8a8269/Issue TrackingRelease Notes
https://www.7-zip.org/download.htmlProduct
https://www.zerodayinitiative.com/advisories/ZDI-23-1165/Third Party AdvisoryVDB Entry