CVE-2026-48111 GHSL-2026-121 7-Zip UEFI DEPEX OOB Read
An off-by-one error in 7-Zip's UEFI parser allows attackers to trigger a crash or leak minor string data via crafted archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48111?
CVE-2026-48111 is a medium-severity vulnerability in mcmilk 7-Zip, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive's Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule → ParseVolume → ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.
Weakness: CWE-125
Which versions are affected by CVE-2026-48111?
It affects 1 product.
Products include 7-Zip 7-Zip.
How do I fix CVE-2026-48111?
Upgrade to a fixed version.
Is CVE-2026-48111 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48111 exists.
Other vulnerabilities in mcmilk 7-Zip
Sources
Also known as ALPINE-CVE-2026-48111, DEBIAN-CVE-2026-48111, ECHO-358c-a231-063b, MINI-45xm-5x8x-pqrp, UBUNTU-CVE-2026-48111.