CVE-2023-52169

The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process.

• CWE-125

• http://www.openwall.com/lists/oss-security/2024/07/03/10
• https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/
• https://sourceforge.net/p/sevenzip/bugs/2402/
• https://www.openwall.com/lists/oss-security/2024/07/03/10
• http://www.openwall.com/lists/oss-security/2024/07/03/10
• https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/
• https://security.netapp.com/advisory/ntap-20241122-0011/
• https://sourceforge.net/p/sevenzip/bugs/2402/
• https://www.openwall.com/lists/oss-security/2024/07/03/10

Published

Jul 3, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52160The implementation of PEAP in wpa_supplicant through 2.10 al…6.5
• CVE-2023-52161The Access Point functionality in eapol_auth_key_handle in e…7.5
• CVE-2023-52162Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 2…6.7
• CVE-2023-52163Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.…8.8
• CVE-2023-52164access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 device…5.1
• CVE-2023-52168The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for …8.4
• CVE-2023-5217Heap buffer overflow in vp8 encoding in libvpx in Google Chr…8.8
• CVE-2023-52173XnView Classic before 2.51.3 on Windows has a Write Access V…9.8
• CVE-2023-52174XnView Classic before 2.51.3 on Windows has a Write Access V…9.8
• CVE-2023-52175Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-52176Authentication Bypass by Spoofing vulnerability in miniorang…5.3
• CVE-2023-52177Missing Authorization vulnerability in SoftLab Integrate Goo…6.3