NanaZip EUVD-2026-36506

The victim must actively open a crafted .avb or .img file using a vulnerable NanaZip installation (versions 3.0.1000.0 through pre-6.0.1698.0) on Windows. The trigger is the AVB vbmeta image parser (AvbHandler), which is invoked automatically when NanaZip encounters these file types - no special NanaZip configuration or feature flag is required beyond having the software installed in the affected version range. Exploitation is limited by the UI:R requirement: the victim must initiate the file-open action. No authentication, elevated privileges, or network service exposure are necessary on the victim system. The crash is deterministic, meaning the DoS outcome is reliable once the file is opened, but reliable memory exfiltration has not been demonstrated.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, score 5.4) accurately reflects the attack profile: network-deliverable file, low crafting complexity, no authentication required, but requires user interaction to open the file. The UI:R constraint is the primary risk limiter - exploitation depends entirely on a victim voluntarily opening a malicious archive. EPSS at 0.05% and 15th percentile is consistently low, and there is no CISA KEV listing, no known public POC, and no evidence of in-the-wild use. The 'Google' and 'Microsoft' tags likely reflect the upstream 7-Zip AVB parser origin (Google's AVB format) and NanaZip's Windows platform rather than separate vendor exposure. The C:L impact is plausible but uncertain - while the heap overread theoretically exposes adjacent memory contents, the description characterizes the primary outcome as a deterministic crash, suggesting information extraction before termination would be incidental rather than reliable. Real-world risk is moderate-low: the vulnerability is user-triggered, crash-only in confirmed behavior, and exploitation interest is demonstrably minimal at this time.

An attacker crafts a malicious .avb or .img file with a value_num_bytes field set to a value that triggers unsigned integer underflow in the bounds check. The file is delivered via email attachment, file-sharing link, or embedded in an archive. When the victim opens the file with a vulnerable NanaZip installation, AddNameToString reads up to ~4 GiB beyond the 64 KiB heap buffer, causing an immediate and deterministic process crash; heap contents in the overread region could theoretically be surfaced before termination. No public POC is currently known.