Loading vulnerability…
Off-by-one out-of-bounds read in 7-Zip UEFI dependency expression parser
CVE-2026-48111 is an off-by-one out-of-bounds read in 7-Zip’s UEFI firmware image parser affecting versions 9.21 through 26.00. The flaw is in the ParseDepedencyExpression function in the UEFI handler, where an attacker-controlled opcode is validated with a greater-than comparison instead of a greater-than-or-equal comparison against the 10-element kExpressionCommands array. As a result, an opcode value equal to the array length is incorrectly accepted and causes the parser to read one pointer-sized slot past the end of the static command table. The out-of-bounds value is then treated as a string pointer and passed to string-handling routines while populating archive metadata. The vulnerable code path is reachable automatically during archive opening through the UEFI parsing flow when processing dependency-expression sections in crafted UEFI firmware images, and the UEFI handler is enabled by default through signature-based format detection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a denial of service through an access violation if the out-of-bounds pointer does not reference readable memory. In some builds, the flaw can also disclose a limited adjacent read-only data string into archive metadata. The disclosure is minor and constrained to adjacent static data; the issue does not provide a write primitive and is not described as exposing heap contents, secrets, or address-space layout information.
If you can’t patch tonight, do this now.
Until an update can be applied, avoid opening or processing untrusted files that may be identified as UEFI firmware images by 7-Zip’s signature-based detection. Where operationally feasible, restrict automated handling of untrusted archives and firmware containers in workflows that invoke 7-Zip parsing.
Patch, then assume compromise.
Upgrade 7-Zip to version 26.01 or later, which fixes the bounds-checking error in the UEFI dependency expression parser. Any bundled or embedded 7-Zip components should also be updated to a fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.