CVE-2016-2335

This flaw lives in how 7-zip/p7zip reads certain UDF “disc image” files. If someone opens a specially crafted file, it can make the program crash, and in the worst case, it could run attacker-controlled code on your computer. Think of it like a broken rule for reading a file’s internal fields—malformed files can trigger the failure or worse.

This matters to you if your business uses 7-zip or p7zip to open or extract files on desktops, servers, or workflows (for example, when employees open attachments or customers send files for processing). The key risk is “file-handling”: an attacker needs to get a user to open a maliciously constructed UDF file, and the problem is triggered during that file processing. It is not listed as reachable in the default configuration here; treat it as a risk mainly when untrusted files are being opened by staff or systems that automatically unpack incoming files.

This is an Amber issue because attackers can target it by getting a user to open a malicious UDF file, and the impact can include crash or unauthorized code execution. There is no public exploit code recorded in the findings and it is not marked as a CISA KEV item, but press attention is rising and the predicted likelihood is trending upward.

Confirm whether you’re exposed

• Look at where 7-zip/p7zip is installed and used:
  • End-user PCs (email attachments, downloaded archives)
  • Servers that process uploads (file transfer portals, document workflows)
  • Any automation that extracts uploaded archives
• Check installed versions of 7-zip and p7zip on those systems.
  • The findings reference affected versions including 7-zip 9.20 and p7zip builds around older releases; match your installed versions against what you run.

Upgrade to the fixed version

• For p7zip: upgrade to 16.02-r1 or later (or your distribution’s equivalent package version).
• For openSUSE specifically: apply the distribution’s recommended guidance from the vendor remediation note provided in the findings.

If you can’t upgrade immediately (temporary reduction)

• Stop automatic extraction of user-supplied archives until the fix is applied.
• Only allow trusted users to open unknown files; block or quarantine suspicious attachments.
• Add an extra gate before extraction: scan incoming archives/UDF files with your existing security tooling.

What to monitor after changes

• Monitor for unusual extraction activity from untrusted sources (e.g., unexpected crashes of 7-zip/p7zip processes).
• If you have centralized logging, confirm that extraction jobs that handle user-provided content continue to work normally after the upgrade.

KEV / exploit notes

• This CVE is not listed in CISA KEV in the findings.
• No public exploit code is recorded in the findings.

Severity: High (CVSS 8.8 is noted in the prompt), with the practical impact being crash (denial of service) or potential remote code execution when a user opens a malicious file. Weakness type: CWE-119 (improper bounds checking / out-of-bounds read).

Mechanism / attack vector: A specially crafted UDF file can trigger a bug in CInArchive::ReadFileItem (Archive/Udf/UdfIn.cpp), using fields in the UDF’s Long Allocation Descriptor (notably PartitionRef) to cause out-of-bounds read and potentially arbitrary code execution. Preconditions from findings: the attacker must deliver a crafted UDF file to the target for processing, and the interaction required is that a user opens the file (“user interaction: Required”).

Exploitation status: Not listed in CISA KEV; no public exploit code on record. However, press attention and predicted likelihood are rising (EPSS was provided in findings, but public blocks should not include the percentage).