NanaZip EUVD-2026-36508

Exploitation requires a victim user on Windows to actively open a specially crafted file that contains a malformed Android Verified Boot (AVB) vbmeta image using a NanaZip installation in the affected version range (3.0.1000.0 to before 6.0.1698.0). The AVB vbmeta parsing path (AvbHandler) must be reachable, which it is by default in affected builds when processing supported archive formats. The CVSS UI:R metric confirms that passive exploitation without user action - such as drive-by network scanning - is not possible. No authentication is required from the attacker side (PR:N), meaning any user with access to the delivery channel can be targeted. Exploitation is further limited by runtime heap layout variability (ASLR) that makes consistent, targeted data extraction non-trivial, and the absence of a write primitive means this vulnerability does not straightforwardly enable code execution. No special system configuration or non-default feature flag is required beyond having an affected NanaZip version installed.

The NVD CVSS 3.1 score of 5.4 Medium is coherent with the attack profile: network-accessible (AV:N), no authentication required (PR:N), and low complexity (AC:L), but gated by mandatory user interaction (UI:R) - the victim must open a malicious archive. The limited C:L and A:L impact ratings accurately reflect that while the out-of-bounds read primitive is theoretically capable of leaking large quantities of heap memory, practical extraction of sensitive data from a desktop file archiver is constrained by ASLR, unpredictable heap layout, and the lack of an output channel beyond application state or crash dumps. EPSS at 0.05% (15th percentile) strongly reinforces low real-world exploitation urgency, and the absence from CISA KEV confirms no confirmed mass exploitation. There is no conflicting signal between CVSS and description regarding attack vector - both indicate network delivery of a malicious file with required user interaction. The primary concern for defenders is information disclosure from heap contents (cached file data, in-memory secrets), not remote code execution, as there is no write primitive indicated by the CWE-125 classification or description. This is a legitimate medium-priority issue for organizations that routinely process untrusted archives, but not an emergency patch requiring immediate operational disruption.

An attacker crafts a malicious archive embedding an AVB vbmeta image with an oversized salt_len field calculated to cause the 32-bit overflow that defeats the pos + ht.salt_len > descSize bounds check. The file is delivered to a Windows target via phishing email, malicious download, or shared network storage, and the victim opens it with a vulnerable NanaZip version. NanaZip's AvbHandler then calls CByteBuffer::CopyFrom with the unchecked length, reading up to ~4 GiB of adjacent heap memory - potentially including cached file contents or in-memory application data - and may crash the process as a side effect.