CVE-2022-29072VulnerabilityPublished 15 Apr 2022Updated 9 Jun 2025

CVE-2022-29072: n/a

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 07:57 UTC

Severity

Medium

Rated Medium by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 1.5% chance of exploitation in 30 days – higher than 74% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Apr 2022
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

2) Restrict or monitor the use of 7-Zip on critical systems, especially limiting user permissions to install or run unauthorized software. 3) Implement application control policies that prevent execution of untrusted or unsigned binaries and restrict drag-and-drop operations in sensitive applications where possible. 4) Educate users about the risks of interacting with untrusted archive files and discourage dragging files into application UI elements without verification. 5) Employ endpoint detection and response (EDR) solutions to monitor for suspicious child process creation by 7zFM.exe or anomalous command executions. 6) Conduct regular audits of installed software and remove unnecessary or outdated applications to reduce attack surface. 7) If feasible, disable or restrict the Help > Contents functionality in 7-Zip or replace 7-Zip with alternative archiving tools that do not exhibit this vulnerability.

Description

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur

Impact

For European organizations, the impact of CVE-2022-29072 depends on the prevalence of 7-Zip usage within their environments, particularly on Windows endpoints. Since 7-Zip is a widely used open-source archiving tool, many organizations may have it installed either officially or by end users. The vulnerability could allow an attacker with local access or the ability to trick a user into performing the drag-and-drop action to execute arbitrary commands, potentially leading to unauthorized actions or lateral movement within the network. However, the lack of confirmed privilege escalation limits the attacker's ability to gain higher system privileges, reducing the risk of full system compromise. The requirement for user interaction (dragging a file into a specific UI area) further reduces the likelihood of automated or remote exploitation. Nonetheless, targeted attacks leveraging social engineering could exploit this vulnerability to execute malicious payloads under the user's context, potentially leading to data theft, installation of malware, or disruption of services. European organizations with strict endpoint security policies and user awareness training may mitigate the risk, but those with less controlled environments could be more vulnerable.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 10 Jul 2025, 19:31 UTC

Technical details

References

Community reviews

Related threats