CVE-2026-47223: falha de média gravidade em M2Team NanaZip
NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.2%
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Produtos afetados
M2Team · NanaZipCVEs relacionadas — M2Team NanaZip
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55780LOWNanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry SizeEPSS 0.6%CVE-2026-54616HIGHNanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return valueEPSS 0.4%CVE-2026-27114MEDIUMNanaZip has ROMFS Archive Infinite LoopEPSS 0.3%CVE-2026-44215MEDIUMNanaZip: Heap out-of-bounds write in NanaZip UFS directory parserEPSS 0.3%CVE-2026-26282MEDIUMNanaZip has DotNet Single file OOB Heap ReadEPSS 0.2%CVE-2026-47224MEDIUMNanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC checkEPSS 0.2%