CVE-2018-10172 - CVE House
Back to Database
Status published High CVE-2018-10172

7-Zip through 18.01 on Windows implements the "Large memory pages"...

Vulnerability Description

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's account, which makes it easier for attackers to bypass intended access restrictions by using this privilege in the context of a sandboxed process. Note: This has been disputed by 3rd parties who argue this is a valid feature of Windows.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10172

Credits & Attribution

No credits recorded in the NVD database.

References

More from 7-zip

View All →
CVE-2022-47069
p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via...
High 7.8
CVE-2022-29072
7-Zip through 21.07 on Windows allows privilege escalation and command...
High 7.8
CVE-2018-5996
Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before...
High 7.8
CVE-2018-10115
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03...
High 7.8
CVE-2017-17969
Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before...
High 7.8

Affected Vendor

Affected Software

7-zip
Vulnerable Versions:
0

Timeline

Official Publish: April 16th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.