CVE-2026-47223: CWE-125: Out-of-bounds Read in M2Team NanaZip
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
AI Analysis
Technical Summary
NanaZip, a 7-Zip derivative for Windows, has a heap out-of-bounds read vulnerability (CWE-125) in its AVB vbmeta image parser, caused by a 32-bit unsigned integer overflow in the bounds check (pos + ht.salt_len > descSize). This overflow allows an attacker to manipulate the salt_len field to bypass validation, leading CByteBuffer::CopyFrom to copy up to approximately 4 GiB beyond the intended buffer boundary. This vulnerability affects versions from 3.0.1000.0 up to but excluding 6.0.1698.0 and has been fixed in version 6.0.1698.0 and later.
Potential Impact
The vulnerability results in a heap out-of-bounds read, which can cause application crashes or potentially expose sensitive memory contents. The CVSS score of 5.4 (medium severity) reflects limited confidentiality impact, no integrity impact, and low availability impact. There are no known exploits in the wild.
Mitigation Recommendations
A fix is available in NanaZip version 6.0.1698.0 and later. Users should upgrade to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-47223: CWE-125: Out-of-bounds Read in M2Team NanaZip
Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
CVSS v3.1
Score 5.4medium
Affected software
pkg:github/m2team/NanaZipRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
NanaZip, a 7-Zip derivative for Windows, has a heap out-of-bounds read vulnerability (CWE-125) in its AVB vbmeta image parser, caused by a 32-bit unsigned integer overflow in the bounds check (pos + ht.salt_len > descSize). This overflow allows an attacker to manipulate the salt_len field to bypass validation, leading CByteBuffer::CopyFrom to copy up to approximately 4 GiB beyond the intended buffer boundary. This vulnerability affects versions from 3.0.1000.0 up to but excluding 6.0.1698.0 and has been fixed in version 6.0.1698.0 and later.
Potential Impact
The vulnerability results in a heap out-of-bounds read, which can cause application crashes or potentially expose sensitive memory contents. The CVSS score of 5.4 (medium severity) reflects limited confidentiality impact, no integrity impact, and low availability impact. There are no known exploits in the wild.
Mitigation Recommendations
A fix is available in NanaZip version 6.0.1698.0 and later. Users should upgrade to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T22:25:21.259Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2c4809e617e2d8349cf161
Added to database: 06/12/2026, 17:55:21 UTC
Last enriched: 06/19/2026, 18:24:55 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 109
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.