CVE-2018-5996 — Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code o
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a c
Published
2018-01-31T18:00:00.000Z
Last modified
2025-01-10T18:55:21.411Z
01What is this vulnerability?
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
02Affected products
| Vendor | Product | Versions |
|---|
| n | a / n/a | n/a |
03Active exploitation status
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
04Recommended remediation
- Patch to a fixed version listed in the vendor advisory (see references below).
- Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
- Hunt historical logs for exploitation indicators — see Detection signatures below.
05Technical details
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
06Detection signatures
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
07Related CVEs
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.
08Timeline
- Published: 2018-01-31T18:00:00.000Z
- Last modified: 2025-01-10T18:55:21.411Z
09References
- landave.io — https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
- www.securitytracker.com — http://www.securitytracker.com/id/1040831
- 0patch.blogspot.si — https://0patch.blogspot.si/2018/02/two-interesting-micropatches-for-7-zip.html
- github.com — https://github.com/p7zip-project/p7zip/issues/8
- github.com — https://github.com/p7zip-project/p7zip/issues/32
Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →