Serious vulnerability discovered in 7-Zip for Windows

In the free and open source archiver 7-Zip discovered serious vulnerability. It is capable of giving an attacker admin-level access without the need to crack a password using a combination of 7-Zip and Windows Help.

The video below shows how the user who discovered the vulnerability exploits it. It drags a fake .7z file that mimics a 7-Zip archive into the program's help window, allowing it to execute commands as an administrator. This gives access to a higher level system and provides access to programs and commands that would normally require a password.

This vulnerability is present in all versions of the application for Windows, the developers have not yet managed to close it. If this bothers you, you don't have to uninstall the program: you can only restrict its rights to read and execute only.