CVE-2026-48111: 
7-Zip vulnerability analysis and mitigation

CVE-2026-48111 is an off-by-one out-of-bounds read vulnerability in 7-Zip's UEFI firmware image parser (CPP/7zip/Archive/UefiHandler.cpp), specifically in the ParseDepedencyExpression function. It affects 7-Zip versions 9.21 through 26.00 and was disclosed on June 5, 2026, following coordinated disclosure initiated on April 21, 2026, with a fix released in version 26.01 on April 27, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (GitHub Security Lab, Feedly).

The root cause is a classic off-by-one error (CWE-125: Out-of-bounds Read) in ParseDepedencyExpression: the function validates an attacker-controlled opcode byte using > instead of >= against Z7_ARRAY_SIZE(kExpressionCommands) (which equals 10), allowing an opcode value of 0x0A (10) to index one slot past the end of the 10-entry kExpressionCommands static const char * array in .rodata. The out-of-bounds pointer is then passed to strlen() and memcpy() into the archive's Characts property. The vulnerability is triggered automatically during IInArchive::Open() via the call path OpenFv()/OpenCapsule() → ParseVolume() → ParseSections() when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A. The UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats (GitHub Security Lab).

Exploitation results in one of two outcomes depending on the binary's linker layout: a deterministic denial of service (access violation crash when the adjacent memory does not form a valid readable pointer) or minor information disclosure of an adjacent .rdata string literal into archive metadata visible in the archive listing UI. There is no write primitive, no heap data disclosure, and no exposure of user secrets or ASLR base addresses — the leaked content, if any, is a static string from the binary's own read-only data segment. The vulnerability triggers automatically upon opening a crafted UEFI firmware archive file, requiring no extraction or further user interaction beyond opening the file (GitHub Security Lab).

1. Craft malicious archive: Use the published PoC Python script to generate a minimal 104-byte UEFI FFS volume containing a SECTION_DXE_DEPEX (type 0x13) section whose first payload byte is 0x0A (opcode value 10).
2. Deliver the file: Distribute the crafted .uef, .scap, or similarly named UEFI firmware image file to the target via email attachment, file share, web download, or any other delivery mechanism that causes the victim to open it with 7-Zip.
3. Trigger automatic parsing: When the victim opens the file in 7-Zip (GUI double-click or CLI 7zz l), IInArchive::Open() is called, which automatically invokes OpenFv()/OpenCapsule() → ParseVolume() → ParseSections() → ParseDepedencyExpression().
4. Trigger OOB read: The opcode byte 0x0A passes the flawed > 10 check (instead of >= 10), causing kExpressionCommands[10] to read one pointer slot past the end of the static array.
5. Achieve DoS or information disclosure: The OOB pointer is dereferenced via strlen() and memcpy(). Depending on the build's linker layout, this either crashes 7-Zip (DoS) or silently copies an adjacent .rdata string into the archive's Characts metadata property, visible in the archive listing (GitHub Security Lab).

• File System: Presence of unexpected small UEFI firmware image files (e.g., .uef, .scap, .fd) in download directories, email attachments, or shared folders with minimal valid structure (~104 bytes or similarly small sizes unusual for legitimate firmware images.
• Logs: 7-Zip crash reports or Windows Error Reporting (WER) entries referencing 7z.dll or 7zz.exe with access violation exceptions (0xC0000005) during archive open operations on UEFI-format files.
• Process: Unexpected termination of 7zFM.exe, 7zz.exe, or 7z.exe processes immediately upon opening a UEFI firmware archive file, without extraction being initiated.
• Network: Delivery of unusually small UEFI firmware image files from untrusted or unexpected external sources via HTTP/HTTPS, email, or file transfer protocols.

The primary remediation is to update 7-Zip to version 26.01 or later, which was released on April 27, 2026, and contains the fix (changing > to >= in the opcode bounds check). If immediate patching is not possible, restrict processing of untrusted UEFI firmware archive files and avoid opening files from untrusted sources with 7-Zip. As a configuration-level workaround, disabling or restricting access to the UEFI handler (7z.dll) in environments where UEFI firmware archive processing is not required can reduce exposure. Detection plugins are available via Nessus (IDs 321160, 321161) and Qualys (ID 288889) (GitHub Security Lab, Feedly).

The vulnerability was discovered and reported by Jaroslav Lobačevski of GitHub Security Lab as part of a broader audit (GHSL-2026-115 through GHSL-2026-122) covering eight distinct memory safety issues across multiple 7-Zip archive format handlers. The coordinated disclosure followed responsible disclosure practices, with the 7-Zip maintainer releasing a fix (v26.01) within six days of the initial report. The oss-security mailing list carried a public disclosure post, and the issues received coverage in Linux security advisories (Fedora) and German Linux security news (GitHub Security Lab, oss-sec).