CVE-2022-29072

CVE-2022-29072 describes a privilege escalation and command execution vulnerability in 7-Zip through version 21.07 on Windows, affecting 7-Zip and Microsoft Windows installations utilizing it. The vulnerability, rated High severity (CVSS 7.8), stems from a misconfiguration in 7z.dll and a heap overflow, allowing an attacker to execute commands in a child process when a .7z file is dragged to the Help>Contents area. Despite the high CVSS score, multiple third parties dispute the privilege escalation claim, and there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community discussion, indicating notable attention.