CVE-2025-33028: winzip

Vulnerability summary

CVE-2025-33028 is a medium (CVSS 6.1) vulnerability in winzip. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.1% of scored vulnerabilities.

Timeline

1. 15-04-2025
   PublishedVulnerability first disclosed.
2. 24-10-2025
   Last modifiedVulnerability information updated.

Description

In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, WinZip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. NOTE: a third party has reported that this is a false positive, and has observed that the original CVE-2025-33028.md file has been deleted on GitHub. Also, this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.

• CWE-830Inclusion of Web Functionality from an Untrusted SourceThe product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.