CVE-2024-11477

CVE-2024-11477 is a remote code execution vulnerability affecting 7-Zip, specifically within its Zstandard decompression implementation. This flaw stems from improper validation of user-supplied data, leading to an integer underflow before memory writes. An attacker can exploit this with user interaction to execute arbitrary code in the context of the current process. The vulnerability carries a high CVSS score of 7.8, indicating significant impact (confidentiality, integrity, availability) with low attack complexity, though it requires user interaction. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered notable community discussion and media coverage, suggesting awareness and potential for future exploitation.