CVE-2026-48111

Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.21 through 26.00

Description An off-by-one out-of-bounds read exists in the ParseDepedencyExpression() function of the UEFI firmware image parser. The issue occurs because the function validates an attacker-controlled opcode byte using a greater-than operator instead of a greater-than-or-equal-to operator against the element count of the kExpressionCommands static array. This allows an opcode value of 10 to read 8 bytes past the end of the array in the .rodata section. The resulting value is dereferenced as a const char * and processed via strlen() and memcpy() into the archive's Characts property. This can lead to a denial of service through an access violation or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The issue is triggered during IInArchive::Open() when processing a SECTION DXE DEPEX (0x13) or SECTION PEI DEPEX (0x1B) section where the first body byte is 0x0A.

Recommendations Update to version 26.01.