NanaZip EUVD-2026-36507

The victim must actively open a crafted LVM2 disk image file using a NanaZip installation between versions 3.0.1000.0 and before 6.0.1698.0 on Windows. NanaZip's LVM disk image support via the inherited 7-Zip LvmHandler is enabled as part of the product's default archive and disk-image handling capability - no special non-default configuration is required to expose the vulnerable code path. User interaction (UI:R) is a hard prerequisite: the malicious file must be deliberately opened by the victim; passive or drive-by delivery alone is insufficient. No authentication, elevated privileges, or special network position is required on the attacker's side. Exploitation is scoped to the NanaZip process (S:U); no lateral movement, privilege escalation, or cross-process impact is implied.

The official CVSS 3.1 base score of 4.3 (Medium) reflects network-deliverable attack vector (AV:N), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and impact limited to low availability (A:L) with no confidentiality or integrity impact. However, the 'Information Disclosure' tag in the source data conflicts with the official C:N rating - CWE-125 heap over-reads inherently risk exposing adjacent heap memory content, which may not be fully captured by C:N; this discrepancy should be verified against the full vendor advisory at GHSA-qcgf-c2vp-fwjr. EPSS at 0.04% (11th percentile) and the absence of a CISA KEV listing together confirm very low exploitation priority. No public exploit code exists. The mandatory user interaction (opening the crafted file) is a meaningful friction point that substantially limits mass exploitation. Overall, this is a low-priority, user-triggered crash-or-leak affecting a desktop archiving utility, not a server-side component - realistic attacker value is limited.

An attacker crafts a malformed LVM2 disk image containing an out-of-bounds field offset in its physical-volume metadata header, then delivers it to a target via email attachment, a malicious download link, or a shared network drive. When the victim opens the file in an unpatched NanaZip installation, the LvmHandler parser reads beyond the allocated heap buffer, causing NanaZip to crash and potentially surfacing adjacent heap memory content. No public exploit code exists at time of analysis, and user interaction to manually open the file is a required step that limits opportunistic mass exploitation.