EUVD-2026-36508Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
File-based delivery requires user to open archive (UI:R, PR:N); heap out-of-bounds read yields partial disclosure and crash risk but no write primitive (C:L, I:N, A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Lifecycle Timeline
3DescriptionCVE.org
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
AnalysisAI
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attackers to read up to approximately 4 GiB of heap memory or crash the application by delivering a crafted archive to a Windows user who opens it. Affected versions span 3.0.1000.0 through all releases before 6.0.1698.0, with the vulnerability rooted in an inherited integer overflow flaw in 7-Zip's upstream AvbHandler. No public exploit code or active exploitation has been identified; an EPSS score of 0.05% (15th percentile) confirms negligible current threat activity, and this CVE does not appear in the CISA KEV catalog.
Technical ContextAI
NanaZip (cpe:2.3:a:m2team:nanazip) is a modern Windows file archiver forked from 7-Zip that includes an AvbHandler capable of parsing Android Verified Boot (AVB) vbmeta images. The vulnerability is classified as CWE-125 (Out-of-Bounds Read) and originates from a 32-bit unsigned integer overflow in the bounds validation expression pos + ht.salt_len > descSize. When an attacker supplies a sufficiently large salt_len value in a crafted vbmeta descriptor, the addition of pos and salt_len wraps around the 32-bit integer boundary, yielding a value smaller than descSize and silently bypassing the intended guard. The corrupted, overflowed length is then passed to CByteBuffer::CopyFrom, which internally calls memcpy using the unchecked length, enabling a read of up to approximately 4 GiB of heap memory beyond the legitimate 64-byte descriptor buffer. This class of integer wraparound is a well-understood arithmetic pitfall in C/C++ parsers handling untrusted binary formats.
RemediationAI
Upgrade NanaZip to stable version 6.0.1698.0 or preview version 6.5.1742.0, both confirmed as patched by the vendor in the GitHub Security Advisory GHSA-qhc5-mh6j-4g75 at https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75. If immediate upgrade is not feasible, instruct users to avoid opening archive files from untrusted sources in NanaZip until patched - particularly files that may contain AVB vbmeta payloads. Sandboxing NanaZip using Windows Sandbox or similar isolation mechanisms can limit the blast radius of a successful heap read exploit by restricting what process memory is accessible. Note that merely changing file extension associations does not mitigate the risk if users manually open files with NanaZip, as the parser is triggered on file content, not extension.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially cra
Memory exhaustion in NanaZip's littlefs filesystem image parser (versions 5.0.1252.0 through before 6.0.1698.0) allows a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today