CVE-2026-47222

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). An unsigned integer underflow in a bounds check allows an attacker-controlled value_num_bytes field to pass validation, causing AddNameToString to read up to ~4 GiB past the end of a 64 KiB heap buffer. This causes a deterministic crash (denial of service) when opening a crafted .avb or .img file. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/M2Team/NanaZip/security/advisories/GHSA-mqqj-crf3-6q37
https://github.com/M2Team/NanaZip/security/advisories/GHSA-mqqj-crf3-6q37

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) NanaZip es el derivado de 7-Zip destinado a la experiencia moderna de Windows. Desde la versión 3.0.1000.0 hasta antes de la versión 6.0.1698.0, existe una lectura fuera de los límites del montón en el analizador de imágenes vbmeta de Android Verified Boot (AVB) en NanaZip (a través del AvbHandler de 7-Zip ascendente). Un subdesbordamiento de entero sin signo en una comprobación de límites permite que un campo value_num_bytes controlado por el atacante pase la validación, haciendo que AddNameToString lea hasta ~4 GiB más allá del final de un búfer de montón de 64 KiB. Esto causa un fallo determinista (denegación de servicio) al abrir un archivo .avb o .img manipulado. Este problema ha sido parcheado en la versión estable 6.0.1698.0 y la versión preliminar 6.5.1742.0.

Information

Published : 2026-06-12 17:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-47222

Mitre link : CVE-2026-47222

CVE.ORG link : CVE-2026-47222

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-47222", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47222", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T17:15:21.985742Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "M2Team", "product": "NanaZip", "versions": [{"status": "affected", "version": ">= 3.0.1000.0, < 6.0.1698.0"}]}]}], "published": "2026-06-12T17:16:24.087", "references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-mqqj-crf3-6q37", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-mqqj-crf3-6q37", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). An unsigned integer underflow in a bounds check allows an attacker-controlled value_num_bytes field to pass validation, causing AddNameToString to read up to ~4 GiB past the end of a 64 KiB heap buffer. This causes a deterministic crash (denial of service) when opening a crafted .avb or .img file. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0."}, {"lang": "es", "value": "NanaZip es el derivado de 7-Zip destinado a la experiencia moderna de Windows. Desde la versi\u00f3n 3.0.1000.0 hasta antes de la versi\u00f3n 6.0.1698.0, existe una lectura fuera de los l\u00edmites del mont\u00f3n en el analizador de im\u00e1genes vbmeta de Android Verified Boot (AVB) en NanaZip (a trav\u00e9s del AvbHandler de 7-Zip ascendente). Un subdesbordamiento de entero sin signo en una comprobaci\u00f3n de l\u00edmites permite que un campo value_num_bytes controlado por el atacante pase la validaci\u00f3n, haciendo que AddNameToString lea hasta ~4 GiB m\u00e1s all\u00e1 del final de un b\u00fafer de mont\u00f3n de 64 KiB. Esto causa un fallo determinista (denegaci\u00f3n de servicio) al abrir un archivo .avb o .img manipulado. Este problema ha sido parcheado en la versi\u00f3n estable 6.0.1698.0 y la versi\u00f3n preliminar 6.5.1742.0."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "security-advisories@github.com"}