CVE-2026-47224 Details

A heap buffer-overflow read vulnerability has been identified in NanaZip versions 3.0.1000.0 prior to 6.0.1698.0. This issue arises in the LVM2 physical-volume metadata parser, where the handler reads an attacker-controlled size field without proper validation. When a crafted LVM disk image is opened, the handler allocates a buffer based on the size but unconditionally reads 508 bytes for a CRC-32 check, leading to an out-of-bounds read of up to 507 bytes past the allocated memory. This vulnerability, originating from an unchecked metadata size field, can be exploited to access adjacent heap memory, potentially leaking sensitive information or causing a crash.

Users are advised to update to NanaZip version 6.0.1698.0 or later. If using a preview version, update to 6.5.1742.0 or later.