Unscored severity · published Dec 31, 2003
CVE-2003-1376
WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the data from the zip file…
–
CVSS
0.2%
EPSS
No
On KEV
Description
WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the data from the zip file by guessing the state of the stream coder.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Winzip · Winzip
8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-1376
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-1376
securityreason.com
http://securityreason.com/securityalert/3265
Exploit
http://www.securityfocus.com/archive/1/311059
www.securityfocus.com
http://www.securityfocus.com/bid/6805
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/11296
More from Winzip
8.8
CVE-2025-1240
WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
7.8
CVE-2024-8811
WinZip Mark-of-the-Web Bypass Vulnerability
6.1
CVE-2025-33028
In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811
–
CVE-2008-3442
WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as…
–
CVE-2007-0264
Buffer overflow in Winzip32.exe in WinZip 9.0 allows local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long command line…