Igor Pavlov · 7-Zip · CVE-2023-52168
**Name of the Vulnerable Software and Affected Versions**
7-Zip versions prior to 24.01
**Description**
The issue is related to a heap-based buffer overflow in the NtfsHandler.cpp NTFS handler. This overflow allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size, specifically at buffer+512*i-2, for i=9, i=10, i=11, etc. The exploitation of this issue may enable a remote attacker to execute arbitrary code.
**Recommendations**
For versions prior to 24.01, update to version 24.01 or later to resolve the issue. As a temporary workaround, consider restricting the use of the NTFS handler in 7-Zip until a patch is applied.