CVE-2026-47223: medium-severity vulnerability in M2Team NanaZip
NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.2%
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Affected products
M2Team · NanaZipRelated CVEs — M2Team NanaZip
In the same product, most dangerous first.
CVE-2026-55780LOWNanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry SizeEPSS 0.6%CVE-2026-54616HIGHNanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return valueEPSS 0.4%CVE-2026-27114MEDIUMNanaZip has ROMFS Archive Infinite LoopEPSS 0.3%CVE-2026-44215MEDIUMNanaZip: Heap out-of-bounds write in NanaZip UFS directory parserEPSS 0.3%CVE-2026-26282MEDIUMNanaZip has DotNet Single file OOB Heap ReadEPSS 0.2%CVE-2026-47224MEDIUMNanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC checkEPSS 0.2%