CVE-2025-44090

Received Received - Intake

Arbitrary Code Execution in OhSoft CoffeeZip

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MITRE

Description

An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2025-44090

Affected Vendors & Products

Vendor	Product	Version / Range
ohsoft	coffeezip	4.8.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code by tricking a user into downloading and opening a specially crafted archive file. The issue arises from improper handling of archive contents, enabling malicious code execution on the victim's system.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious code on your computer, potentially leading to data theft, system damage, or unauthorized access. Users running vulnerable versions of CoffeeZip are at risk if they interact with untrusted archive files.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves arbitrary code execution via crafted archive files in OhSoft CoffeeZip v4.8.0.0, which may pose risks to data integrity or confidentiality if exploited, but no explicit compliance implications are mentioned.

Mitigation Strategies

Uninstall or disable OhSoft CoffeeZip v4.8.0.0 immediately. Avoid downloading or executing archive files from untrusted sources. Update to the latest version if a patch is available.

Hi! I’m here to help you understand CVE-2025-44090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70