Outdated vulnerable version of 7z.exe embedded in Vortex as of right now

[Aldao444]

My AV complains hard about this. It is also a well known vulnerability https://nvd.nist.gov/vuln/detail/CVE-2024-11477

[Pickysaurus]

Do you definitely have the latest version of Vortex? I'm pretty sure we did and update to 7z a while back now. 

[showler]

Might it be related to this: 

 

[Tannin42]

  On 12/2/2024 at 5:03 PM, Pickysaurus said:

Do you definitely have the latest version of Vortex? I'm pretty sure we did and update to 7z a while back now. 

Expand  

Yes, a while back. The last 7z update was over a year ago (based on github history). This vulnerability has been published last week.

So yes, I agree with the OP, Vortex is probably affected by this.

[Nagev]

Thank you for the heads up - noticed this a bit too late and didn't get to add it to todays patch release; but will make sure we take care of this for the next one.