CVE-2026-48111: 7-Zip UEFI Parser Out-of-Bounds Read (v9.21–26.00)

Technical summary

The vulnerability exists in the ParseDepedencyExpression function (CPP/7zip/Archive/UefiHandler.cpp) of 7-Zip's UEFI firmware image parser. The function validates an attacker-controlled opcode byte against a 10-entry static array (kExpressionCommands) using a > comparison instead of >=, permitting an opcode value of 10 to bypass validation. This causes the function to read one pointer slot (8 bytes on 64-bit systems) past the array's boundary in read-only data. The out-of-bounds pointer is then dereferenced as a const char*, and the resulting string is processed through strlen and memcpy into the archive's Characts property. The vulnerability is reached via the IInArchive::Open() call path (OpenFv/OpenCapsule → ParseVolume → ParseSections) when the UEFI handler encounters a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first byte is 0x0A. The UEFI handler is enabled by default in stock 7z.dll and detects both UEFIc and UEFIf formats automatically. The outcome is deterministic but linker-layout dependent—either an access violation (denial of service) or silent disclosure of an adjacent read-only string literal. No write primitive, heap disclosure, secret exfiltration, or ASLR base leak is possible.

Business impact

For organizations that use 7-Zip to process untrusted archive files—particularly firmware updates, OEM appliance images, or UEFI capsule archives—this vulnerability poses a limited but real operational risk. A denial-of-service condition could disrupt batch processing or automated firmware validation workflows. The potential for information disclosure, while constrained to adjacent string literals in read-only memory, could theoretically aid reconnaissance in multi-stage attacks, though the leaked data is not cryptographic material, configuration secrets, or ASLR base addresses. Affected deployments should prioritize patching to eliminate both the crash vector and the information leak.

Affected systems

7-Zip versions 9.21 through 26.00 are vulnerable when the UEFI firmware image parser is invoked. This occurs by default in standard 7z.dll installations when processing archive files. The vulnerability is triggered only when parsing archives containing SECTION_DXE_DEPEX or SECTION_PEI_DEPEX sections with specific malformed content, making it relevant primarily to organizations that handle UEFI firmware images, BIOS updates, system firmware capsules, or similar binary archives. Version 26.01 and later contain the fix.

Exploitability

The vulnerability is mechanically exploitable—a specially crafted archive file will trigger the flaw automatically during normal file opening without requiring user interaction beyond launching 7-Zip. However, practical exploitation is narrowly scoped: the attacker must construct a valid UEFI firmware image structure with a malicious SECTION_DXE_DEPEX or SECTION_PEI_DEPEX section, and the outcome (crash versus silent leak) is deterministic per compiled binary but dependent on linker layout. The leaked information is restricted to adjacent string literals in read-only memory segments and does not include heap data, secrets, or address space layout information. The flaw does not provide code execution or write primitives. Exploitation is most feasible in scenarios where an attacker controls firmware updates or system image distribution.

Remediation

Upgrade 7-Zip to version 26.01 or later, which corrects the off-by-one comparison operator in the ParseDepedencyExpression function. If immediate patching is not feasible, consider disabling UEFI firmware image processing if your workflow permits (though this is not a standard configuration option and may require recompilation or third-party tools). Restrict archive processing to trusted sources and avoid opening UEFI firmware images or BIOS updates from untrusted vendors until patched.

Patch guidance

7-Zip version 26.01 resolves the vulnerability. Verify the installed version via Help > About or command-line (7z.exe). Download the latest stable release from the official 7-Zip website, not mirrors or secondary sources. For enterprise deployments, test the update in a staging environment with your standard firmware image workflows to confirm no behavioral changes. No known backwards-compatibility issues are reported; the patch modifies only the comparison logic.

Detection guidance

Monitor for 7-Zip crashes (access violations) when processing UEFI firmware archives, especially BIOS updates or OEM appliance images. Log any IInArchive::Open() failures in processes handling firmware binaries. Inspect incoming firmware updates for SECTION_DXE_DEPEX or SECTION_PEI_DEPEX sections with unusual first bytes (0x0A in particular), though this requires binary analysis tools. In centralized logging environments, correlate 7-Zip process terminations with firmware processing workflows. Note that successful silent information leaks into archive metadata may not trigger alerts; inspect the Characts properties of processed archives for unexpected string content if forensic analysis is warranted.

Why prioritize this

Although the CVSS score of 4.3 reflects low to medium severity, this vulnerability merits prompt attention for organizations handling firmware images because: (1) the attack surface is automatic—no special user interaction is required; (2) the flaw affects a widely deployed utility with default enabled UEFI parsing; (3) firmware supply chains are high-value targets, and information disclosure into metadata can support reconnaissance; (4) the fix is straightforward and low-risk. Organizations not processing UEFI firmware images can deprioritize but should still patch opportunistically.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: network-accessible vector (archives obtained remotely), low complexity (trivial to craft the payload), no authentication, user interaction required (opening the archive), no impact on confidentiality of primary data (only read-only string literals leak), no integrity impact, and limited availability impact (denial of service only in specific configurations). The score does not account for the narrow scope of affected workloads (UEFI firmware processing) or the deterministic nature of the flaw; for organizations in the firmware supply chain, contextual risk is higher than the generic score suggests.

Frequently asked questions