CVE-2025-44089

Deferred Deferred - Pending Action

Arbitrary Code Execution in NCH ExpressZip

Publication date: 2026-07-22

Last updated on: 2026-07-24

Assigner: MITRE

Description

An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-24

Generated

2026-08-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-11

NVD

CVE-2025-44089

Affected Vendors & Products

Vendor	Product	Version / Range
nch_software	expresszip	11.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability is in NCH Software ExpressZip version 11.29. It allows attackers to execute arbitrary code by tricking a user into downloading and opening a specially crafted archive file. This happens because the software does not properly validate or handle malicious files.

Detection Guidance

Detection of this vulnerability requires monitoring for suspicious archive files or unusual execution behavior. Check for downloads of ExpressZip archives from untrusted sources and verify file integrity. Use antivirus tools to scan for malicious archives and monitor system logs for unexpected code execution.

Impact Analysis

If you use ExpressZip v11.29, an attacker could exploit this to run malicious code on your system. This could lead to data theft, system damage, or unauthorized access to your computer. Simply downloading and opening a malicious archive file could trigger the attack.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The vulnerability involves arbitrary code execution via crafted archive files, which could potentially lead to data breaches or unauthorized access, but specific compliance implications are not detailed.

Mitigation Strategies

Update NCH Software ExpressZip to the latest version. Avoid downloading or executing archive files from untrusted sources. Use antivirus software to scan downloaded files.

Hi! I’m here to help you understand CVE-2025-44089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70