CVE-2026-47223 Details
Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
A heap out-of-bounds read vulnerability has been identified in NanaZip versions 3.0.1000.0 prior to 6.0.1698.0. The issue arises in the Android Verified Boot (AVB) vbmeta image parser, specifically within the hashtree descriptor handling. A 32-bit unsigned integer overflow in the validation of the salt length field allows for an attacker to craft a vbmeta image that bypasses normal checks. This manipulation causes a memory copy operation to read approximately 4 GiB beyond the allocated buffer, leading to a crash. The vulnerability can be exploited by opening a specially crafted .avb or .img file, causing a deterministic denial-of-service by crashing the application.
Users can update to NanaZip stable version 6.0.1698.0 or preview version 6.5.1742.0, both of which contain the patch for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| M2Team NanaZip | >= 3.0.1000.0, < 6.0.1698.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 13, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |