From 607d3fc644652efce8a826d08b0098844795e679 Mon Sep 17 00:00:00 2001
From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Date: Wed, 28 Jan 2026 14:06:13 -0600
Subject: [PATCH] Fixed false negative CVE for 7-Zip installed with MSI
 installer (#38922)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #36335

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Fixed false negative CVE vulnerability detection for 7-Zip
installations on Windows (MSI). Version numbers are now correctly
normalized to industry standards, enabling accurate identification of
applicable security vulnerabilities for this software.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---
 changes/36335-7-zip-false-negative-cve |  1 +
 server/vulnerabilities/nvd/cpe.go      | 20 ++++++++++++++++++++
 server/vulnerabilities/nvd/cpe_test.go | 13 +++++++++++++
 3 files changed, 34 insertions(+)
 create mode 100644 changes/36335-7-zip-false-negative-cve

diff --git a/changes/36335-7-zip-false-negative-cve b/changes/36335-7-zip-false-negative-cve
new file mode 100644
index 0000000000..00e9cad8c5
--- /dev/null
+++ b/changes/36335-7-zip-false-negative-cve
@@ -0,0 +1 @@
+Fixed false negative CVE for 7-Zip installed with MSI installer.
diff --git a/server/vulnerabilities/nvd/cpe.go b/server/vulnerabilities/nvd/cpe.go
index d3612e4854..8182e762d5 100644
--- a/server/vulnerabilities/nvd/cpe.go
+++ b/server/vulnerabilities/nvd/cpe.go
@@ -455,6 +455,26 @@ var (
 				s.Name = "ninxsoft-mist"
 			},
 		},
+		{
+			// 7-Zip on Windows installed with MSI reports versions like "24.09.00.0" but NVD uses "24.09".
+			// Strip trailing ".00.0" components to match NVD version format.
+			// See https://github.com/fleetdm/fleet/issues/36335
+			matches: func(s *fleet.Software) bool {
+				return strings.HasPrefix(s.Name, "7-Zip") && s.Source == "programs"
+			},
+			mutate: func(s *fleet.Software, logger log.Logger) {
+				parts := strings.Split(s.Version, ".")
+				switch len(parts) {
+				case 0, 1:
+					level.Debug(logger).Log("msg", "unexpected 7-Zip version format", "source", "programs", "name", s.Name, "version", s.Version)
+					return
+				case 2:
+					return // Already in the correct format
+				default:
+					s.Version = parts[0] + "." + parts[1]
+				}
+			},
+		},
 	}
 )
 
diff --git a/server/vulnerabilities/nvd/cpe_test.go b/server/vulnerabilities/nvd/cpe_test.go
index 0b84026481..84b67f89d9 100644
--- a/server/vulnerabilities/nvd/cpe_test.go
+++ b/server/vulnerabilities/nvd/cpe_test.go
@@ -2443,6 +2443,19 @@ func TestMutateSoftware(t *testing.T) {
 				BundleIdentifier: "com.ninxsoft.mist",
 			},
 		},
+		{
+			name: "7-Zip on Windows with four-part MSI version",
+			s: &fleet.Software{
+				Name:    "7-Zip 24.09 (x64)",
+				Version: "24.09.00.0",
+				Source:  "programs",
+			},
+			sanitized: &fleet.Software{
+				Name:    "7-Zip 24.09 (x64)",
+				Version: "24.09",
+				Source:  "programs",
+			},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			require.NotPanics(t, func() { mutateSoftware(tc.s, log.NewNopLogger()) })