CVE-2026-48111

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive's Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule → ParseVolume → ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.

• CWE-125

• https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/Exploit, Patch, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2026-115_GHSL-2026-122_7-zip/Exploit, Patch, Third Party Advisory

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-481047-Zip is a file archiver with a high compression ratio. Vers…4.2
• CVE-2026-48107Russh is a Rust SSH client & server library. From version 0.…6.5
• CVE-2026-48108Russh is a Rust SSH client & server library. From version 0.…5.3
• CVE-2026-48109MessagePack for C# is a MessagePack serializer for C#. Prior…8.2
• CVE-2026-4811The WPB Floating Menu & Categories for WordPress – Sticky Si…4.9
• CVE-2026-48110Russh is a Rust SSH client & server library. From version 0.…7.5
• CVE-2026-481127-Zip is a file archiver with a high compression ratio. Vers…6.5
• CVE-2026-48113Chisel is a TCP/UDP tunnel, transported over HTTP and secure…8.5
• CVE-2026-48114Metacat is data repository software that helps researchers p…9.8
• CVE-2026-48115Misskey is an open source, federated social media platform. …6.3
• CVE-2026-48116AnythingLLM is an application that turns pieces of content i…8.8
• CVE-2026-48117DroneAware is a drone detection platform. The centralized Dr…6.8