The flaw is an off‑by‑one out‑of‑bounds read in the UEFI firmware image parser’s ParseDepedencyExpression function. An attacker‑controlled opcode byte that equals 10 bypasses the bounds check and causes the parser to dereference a pointer slot beyond the end of a 10‑entry array. The dereferenced memory is passed through string functions and copied into archive metadata, which can trigger an access violation (a crash) or leak adjacent .rdata string literals. The vulnerability does not provide a write primitive, does not expose hash, chain, or ASLR base addresses, and therefore does not directly compromise secrets.

Versions 9.21 through 26.00 of the 7‑Zip archiver from the vendor mcmilk contain this issue. The flaw is automatically exercised when an archive with a UEFI SECTION_DXE_DEPEX or SECTION_PEI_DEPEX header (opcode 0x0A) is opened, because the UEFI handler is enabled by default in the stock 7z.dll. The vendor released a fix in 7‑Zip 26.01, which removes the bounds check error.

With a CVSS score of 4.3 the risk is moderate. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an archive processed by the UEFI handler, which is on by default, so a local or remote attacker who can supply a crafted archive to a system running 7‑Zip can cause a graceful crash or a silent leak. Because the outcome is deterministic per build but linker‑layout dependent, an attacker cannot reliably choose the exact payload, but the potential denial of service warrants mitigation.