NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow

Description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Scores

EPSS (exploitation in 30 days)

0.22% · top 87% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-125: Out-of-bounds Read (opens in a new tab)All about CWE-125 and its CVEs
• CWE-190: Integer Overflow or Wraparound (opens in a new tab)All about CWE-190 and its CVEs

Affected products

• M2Team · NanaZip

  • affected >= 3.0.1000.0, < 6.0.1698.0

References (1)

• https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75 (opens in a new tab)x_refsource_CONFIRMexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-47223](https://trackcve.app/badge/CVE-2026-47223.svg)](https://trackcve.app/cve/CVE-2026-47223)

Record last updated 13 Jun 2026, 03:23 UTC.