DEBIAN-CVE-2026-48111
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-48111
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48111.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-48111
- Upstream
- Published
- 2026-06-05T17:16:48Z
- Modified
- 2026-09-14T17:03:41Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive's Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule → ParseVolume → ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.
- References
Affected packages
Debian:12 / 7zip
Package
- Name
- 7zip
- Purl
- pkg:deb/debian/7zip?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed22.01+really26.01+dfsg-0+deb12u1
Debian:13 / 7zip
Package
- Name
- 7zip
- Purl
- pkg:deb/debian/7zip?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
24.*
25.*
26.*
Debian:14 / 7zip
Package
- Name
- 7zip
- Purl
- pkg:deb/debian/7zip?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed26.01+dfsg-1
Affected versions
24.*
25.*
26.*
Debian:12 / p7zip
Package
- Name
- p7zip
- Purl
- pkg:deb/debian/p7zip?arch=source&distro=bookworm
Debian:13 / p7zip
Package
- Name
- p7zip
- Purl
- pkg:deb/debian/p7zip?arch=source&distro=trixie