Skip to main content

NanaZip EUVD-2026-36506

| CVE-2026-47222 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-12 GitHub_M
Microsoft Information Disclosure Denial Of Service Google Buffer Overflow Nanazip
5.4
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
vuln.today AI
5.4 MEDIUM

File delivered over network (AV:N), no crafting complexity (AC:L), no privileges needed (PR:N), but user must open file (UI:R); heap overread yields limited confidentiality exposure (C:L) and deterministic crash (A:L) with no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

3
Patch available
Jun 12, 2026 - 18:01 EUVD
Analysis Generated
Jun 12, 2026 - 17:36 vuln.today
CVE Published
Jun 12, 2026 - 16:56 cve.org
MEDIUM 5.4

DescriptionCVE.org

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). An unsigned integer underflow in a bounds check allows an attacker-controlled value_num_bytes field to pass validation, causing AddNameToString to read up to ~4 GiB past the end of a 64 KiB heap buffer. This causes a deterministic crash (denial of service) when opening a crafted .avb or .img file. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

AnalysisAI

Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may leak heap memory contents when a victim opens a crafted .avb or .img file. Affected versions span 3.0.1000.0 through any release before 6.0.1698.0, covering a wide install base of Windows users. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious .avb/.img with underflowing value_num_bytes
Delivery
Deliver file to victim via email or download
Exploit
Victim opens file in NanaZip
Execution
AvbHandler bounds check bypassed via unsigned underflow
Persist
AddNameToString reads ~4 GiB past 64 KiB heap buffer
Impact
Process crash (DoS) with potential incidental heap data exposure
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The victim must actively open a crafted .avb or .img file using a vulnerable NanaZip installation (versions 3.0.1000.0 through pre-6.0.1698.0) on Windows. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, score 5.4) accurately reflects the attack profile: network-deliverable file, low crafting complexity, no authentication required, but requires user interaction to open the file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious .avb or .img file with a value_num_bytes field set to a value that triggers unsigned integer underflow in the bounds check. The file is delivered via email attachment, file-sharing link, or embedded in an archive. …
Remediation Upgrade NanaZip to stable version 6.0.1698.0 or preview version 6.5.1742.0, both of which contain the patch per the vendor advisory at https://github.com/M2Team/NanaZip/security/advisories/GHSA-mqqj-crf3-6q37. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-47223 MEDIUM
5.4 Jun 12

Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
CVE-2026-47224 MEDIUM
4.3 Jun 12

Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c

Share

EUVD-2026-36506 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy