Important context added by the one who found the vulnerability here[1].
A key factor seems to be 7-Zip doesn't just consider file extensions when determining if a file is an archive:
Now the interesting thing is 7-ZIP will not only look at the file extension BUT the files magic bytes "\x37\x7A\xBC\xAF \x27 \x1C" in the header. Recognizing the 7-Zip magic bytes, 7-Zip will then proceed to process this file as an archive, the contents of which will not receive mark-of-the-web protections due to CVE-2025-0411.
1 comment
[ 3.7 ms ] story [ 13.5 ms ] threadA key factor seems to be 7-Zip doesn't just consider file extensions when determining if a file is an archive:
Now the interesting thing is 7-ZIP will not only look at the file extension BUT the files magic bytes "\x37\x7A\xBC\xAF \x27 \x1C" in the header. Recognizing the 7-Zip magic bytes, 7-Zip will then proceed to process this file as an archive, the contents of which will not receive mark-of-the-web protections due to CVE-2025-0411.
[1]: https://arstechnica.com/civis/threads/7-zip-0-day-was-exploi...