CVE-2025-33028

CVE-2025-33028 is a Mark-of-the-Web (MotW) bypass vulnerability in WinZip (up to version 29.0 or 76.9, depending on the source). It stems from an incomplete fix for CVE-2024-8811. The vulnerability allows attackers to craft malicious archives that, when opened with WinZip, cause extracted files to lose the MotW tag. This tag is a Windows security feature that flags files downloaded from the internet, prompting a security warning before execution, especially for files containing macros or executables. Because WinZip strips the MotW tag, extracted malicious files are treated as trusted, local files. This allows malicious code within those files, such as macro-enabled Office documents or scripts, to execute without triggering the usual security alerts. An attacker could then execute arbitrary code within the context of the current user, potentially leading to malware installation, privilege escalation, or sensitive information disclosure. User interaction is required to exploit this vulnerability, as the target must open a malicious archive.