CVE-2025-29864
BaseFortify
Publication date: 2025-12-03
Last updated on: 2025-12-04
Assigner: KrCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| estsoft | alzip | 12.29 |
| estsoft | alzip | 12.01 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Protection Mechanism Failure in ESTsoft ALZip on Windows that allows bypassing the SmartScreen security feature. It affects ALZip versions from 12.01 before 12.29. Essentially, this means that the software's built-in protections designed to warn or block potentially unsafe files can be circumvented, potentially allowing malicious files to be extracted or executed without triggering SmartScreen warnings. [1]
How can this vulnerability impact me? :
The vulnerability can impact users by allowing malicious files to bypass SmartScreen protections during extraction with ALZip. This could lead to unauthorized or harmful programs being installed or executed on the system without the usual security warnings, increasing the risk of malware infection or system compromise. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update ALZip to version 12.29 or later, as versions before 12.29 are affected. Applying the latest patches, such as those in versions 12.30 and 12.31, will address security issues including the SmartScreen bypass and unauthorized program installation vulnerabilities. Additionally, ensure your system is running Windows 10 or 11, as support for earlier versions has ended. [1]