7-Zip

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. 7-Zip is named by URL in the Tier 1 scope table under "Widespread decompression libraries", so the full $15,000 column is reachable rather than the $5,000 Tier 2 cap. Memory-safety hardening can carry a 2× or 3× multiplier through the end of 2026, and the panel may split an award between the submitter and the maintainers. Patches must be between one and twelve months old, submissions are rate-limited to three a month, and sanctions and territory exclusions apply. CVE history 11 Last 12 months 22 Lifetime Memory safety 55 % Parsing/validation 25 % Code execution 12 % Denial of service 5 % Latest advisories Loading the feed Overview 7-Zip is the default third-party archiver on a very large share of Windows desktops, and its LZMA SDK travels much further than the application: installers, game engines, firmware packers and malware-analysis tooling all vendor it. Archive parsers are a direct route to code execution because people open untrusted archives from email and the web by reflex. Eleven of 7-Zip's twenty-two lifetime advisories were published in 2026, so this is an actively attacked parser on a steep curve. The project pays nothing for a vulnerability report and takes them through GitHub private vulnerability reporting, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The 7-Zip archiver core and the LZMA and LZMA2 SDK that is embedded in software far beyond 7-Zip itself The compression and decompression codecs: LZMA, PPMd, BZip2 and Deflate Archive format handlers across 7z, ZIP, RAR, TAR, ISO, CAB, MSI, NSIS, WIM and VHD, each of which is its own parser reading attacker-authored bytes Header parsing and archive metadata handling, where most of the real bugs have historically lived The Windows GUI shell integration and the 7z and 7za command-line front ends Out of scope Vulnerability reports with no merged patch behind them, which earn nothing on Google's rail Patches older than twelve months or newer than one month, which fall outside the program's age window Cosmetic changes and refactors with no security effect Third-party forks and repackagings such as NanaZip and 7-Zip ZS, which the Tier 1 row does not cover Issues in the unRAR-licensed code, where the licence forbids deriving a competing implementation Most-valued findings Memory corruption in an archive format handler triggered by opening or previewing a crafted archive. That is 55% of 7-Zip's bug history and the route to code execution, and it is the class Google's Tier 1 row exists to fund Header and metadata parsing defects, historically where the real bugs live, since the header is read before any content is decompressed Codec-level bounds errors in LZMA, LZMA2, PPMd or BZip2, which propagate into every product that vendors the SDK rather than staying inside the application Path traversal or absolute-path writes during extraction that place a file outside the destination directory Structural hardening that closes a whole class of bounds errors across handlers at once, which is the complicated, high-impact shape the $15,000 row is written for and which can also carry the memory-safety multiplier Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The cash on Google's rail is paid for a merged upstream patch. A vulnerability report on its own earns nothing there Keep the patch merged, without reverts, for one month before claiming, and submit it while it is at least one month and no more than twelve months old Three Patch Rewards submissions per person per month is the hard cap The reward panel may split an award between the submitter and the maintainers, so the full Tier 1 figure is a ceiling rather than an entitlement The memory-safety multipliers that can double or triple an award run to the end of 2026 Google cannot pay individuals or entities on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure 7-Zip takes security reports through GitHub private vulnerability reporting on the official ip7z/7zip source mirror, and pays nothing for them. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability