EUVD-2026-36506Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
File delivered over network (AV:N), no crafting complexity (AC:L), no privileges needed (PR:N), but user must open file (UI:R); heap overread yields limited confidentiality exposure (C:L) and deterministic crash (A:L) with no integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). An unsigned integer underflow in a bounds check allows an attacker-controlled value_num_bytes field to pass validation, causing AddNameToString to read up to ~4 GiB past the end of a 64 KiB heap buffer. This causes a deterministic crash (denial of service) when opening a crafted .avb or .img file. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
AnalysisAI
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may leak heap memory contents when a victim opens a crafted .avb or .img file. Affected versions span 3.0.1000.0 through any release before 6.0.1698.0, covering a wide install base of Windows users. No public exploit code exists and EPSS sits at 0.05% (15th percentile), indicating low current exploitation interest, though the deterministic crash behavior lowers the bar for denial-of-service abuse.
Technical ContextAI
NanaZip (CPE: cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*) is a modern Windows archiver forked from 7-Zip. It inherits the upstream AvbHandler component, which parses Android Verified Boot vbmeta image structures - a format used to verify Android firmware partition integrity. The root cause is CWE-125 (Out-of-Bounds Read): a bounds check on the attacker-controlled value_num_bytes field suffers an unsigned integer underflow, allowing the value to wrap around and pass validation. The AddNameToString function subsequently uses this corrupted field as a read length, walking up to approximately 4 GiB past the boundary of a 64 KiB heap buffer. The underflow pattern is a classic CWE-191 precursor to CWE-125: because the field is unsigned, subtracting a larger value from a smaller one produces a very large positive number rather than a negative, bypassing the guard. The CVSS C:L rating (confirmed by the 'Information Disclosure' tag) reflects that heap data read during this overrun may be observable before the crash terminates the process.
RemediationAI
Upgrade NanaZip to stable version 6.0.1698.0 or preview version 6.5.1742.0, both of which contain the patch per the vendor advisory at https://github.com/M2Team/NanaZip/security/advisories/GHSA-mqqj-crf3-6q37. These are the only confirmed fixed releases; no earlier backport versions are identified. If immediate upgrade is not feasible, a targeted compensating control is to configure Windows to open .avb and .img files with a different application (or block them at mail gateways and download proxies), preventing NanaZip from invoking the vulnerable AvbHandler on untrusted inputs. This has the trade-off of disrupting legitimate Android firmware inspection workflows. There are no known configuration flags within NanaZip to disable the AVB parser selectively, so file-type blocking or upgrade are the only actionable mitigations.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially cra
Memory exhaustion in NanaZip's littlefs filesystem image parser (versions 5.0.1252.0 through before 6.0.1698.0) allows a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today