CVE-2026-47222: NanaZip Heap Out-of-Bounds Read in AVB Parser – MEDIUM Severity

Technical summary

The vulnerability stems from an unsigned integer underflow in the AVB vbmeta image parser's bounds-checking logic, inherited from the upstream 7-Zip AvbHandler component. Specifically, insufficient validation of the value_num_bytes field allows an attacker-controlled value to bypass bounds checks. This permits the AddNameToString function to attempt reading approximately 4 GB of memory starting from a 64 KiB heap buffer, causing an out-of-bounds read that reliably crashes the process. The flaw combines CWE-125 (out-of-bounds read) with CWE-191 (integer underflow), both present in the validation routine.

Business impact

For organizations using NanaZip as part of their standard Windows toolkit, this vulnerability creates a localized denial-of-service risk if users can be tricked into opening untrusted .avb or .img files—particularly in environments where such image files are routinely received or processed. The impact is primarily availability-related (application crash) rather than confidentiality or integrity compromise. However, the ability to trigger deterministic crashes through file opening could be weaponized in workflows where automated image processing occurs without prior file validation.

Affected systems

NanaZip versions 3.0.1000.0 through 5.x (all versions before 6.0.1698.0) are vulnerable on Windows systems where the application is installed and used to open archive or image files. The vulnerability does not affect other 7-Zip builds or non-Windows variants. Users on stable release channels should target version 6.0.1698.0 or later; preview/pre-release users should ensure they are on version 6.5.1742.0 or later.

Exploitability

Exploitation requires user interaction: an attacker must convince or socially engineer a user into opening a malicious .avb or .img file using NanaZip. The crafted file itself is non-trivial to produce (requires specific manipulation of the value_num_bytes field to trigger the underflow), but once created, the crash is deterministic and reliable. Network vector is possible if the file is delivered via email, file-sharing service, or compromised download source. No authentication or elevated privileges are needed, and the attack succeeds against default NanaZip installations.

Remediation

Update NanaZip to version 6.0.1698.0 (stable release) or 6.5.1742.0 (preview release) or later. Organizations should treat this as a moderate-priority patch given the user-interaction requirement and denial-of-service nature. Until patching, users should avoid opening .avb and .img files from untrusted sources, and organizations may implement file-type restrictions or warnings for these formats.

Patch guidance

Stable-track users should update to version 6.0.1698.0 or any subsequent stable release. Preview or early-adopter tracks should upgrade to version 6.5.1742.0 or later. Verify the version number post-update by checking NanaZip's About dialog or properties. No workarounds bypass the flaw short of not opening untrusted image files; patching is the recommended path. Test the update in a controlled environment if NanaZip is integrated into automated workflows.

Detection guidance

Monitor for NanaZip process crashes when users open .avb or .img files, especially from external or untrusted sources. Endpoint Detection and Response (EDR) tools can flag suspicious file-open sequences if NanaZip consistently crashes on specific files. Network detection is unlikely to reveal the attack itself, but monitoring for delivery of .avb/.img files to user desktops—particularly in high-volume or suspicious patterns—may provide early warning. Legacy security tools with application behavior analysis may detect the out-of-bounds memory access, though the crash occurs locally and may not generate network artifacts.

Why prioritize this

Although rated MEDIUM severity (CVSS 5.4), this vulnerability should be prioritized moderately rather than deferred because: (1) it is reliably exploitable through a simple user-interaction vector; (2) attackers can use it to disrupt workflows or create support burden; (3) the patch is straightforward and low-risk; and (4) NanaZip is a consumer-grade utility with wide distribution, so vulnerable installations are likely numerous. Organizations with heavy reliance on image-file processing workflows should prioritize patching above the baseline MEDIUM score.

Risk score, explained

The CVSS 5.4 score (MEDIUM) reflects a network-reachable, user-interaction-required attack that causes availability loss (process crash) and minor information disclosure via memory read. The score does not account for impact on specific business workflows; organizations processing many .avb/.img files should consider local context. The absence of remote code execution, privilege escalation, or data exfiltration capabilities keeps the score moderate. However, the deterministic, reliable nature of the crash and the low barrier to crafting a malicious file should inform local risk decisions.

Frequently asked questions