CVE-2016-2335

This flaw lives in how 7-zip/p7zip reads certain UDF “disc image” files. If someone opens a specially crafted file, it can make the program crash, and in the worst case, it could run attacker-controlled code on your computer. Think of it like a broken rule for reading a file’s internal fields—malformed files can trigger the failure or worse.

This matters to you if your business uses 7-zip or p7zip to open or extract files on desktops, servers, or workflows (for example, when employees open attachments or customers send files for processing). The key risk is “file-handling”: an attacker needs to get a user to open a maliciously constructed UDF file, and the problem is triggered during that file processing. It is not listed as reachable in the default configuration here; treat it as a risk mainly when untrusted files are being opened by staff or systems that automatically unpack incoming files.

This is an Amber issue because attackers can target it by getting a user to open a malicious UDF file, and the impact can include crash or unauthorized code execution. There is no public exploit code recorded in the findings and it is not marked as a CISA KEV item, but press attention is rising and the predicted likelihood is trending upward.