CVE-2026-47223: NanaZip vbmeta Integer Overflow Heap Read – Patch to 6.0.1698.0

Technical summary

The vulnerability stems from an integer overflow in the AVB vbmeta image parser (inherited from upstream 7-Zip's AvbHandler). A 32-bit unsigned integer overflow occurs in the bounds validation logic: pos + ht.salt_len > descSize. An attacker-controlled salt_len field can be set to a value that wraps the integer addition, bypassing the bounds check. This allows a subsequent memcpy operation (CByteBuffer::CopyFrom) to read approximately 4 GiB past the end of the heap buffer containing the 64-byte vbmeta descriptor. The root causes are CWE-125 (out-of-bounds read) and CWE-190 (integer overflow), enabling memory disclosure or denial of service.

Business impact

For organizations that process or validate Android firmware images as part of security analysis, compliance, or supply-chain verification workflows, this flaw introduces information disclosure and availability risks. An attacker could embed a malicious vbmeta file in firmware bundles or device images intentionally shared with security teams, causing heap corruption in analysis tools. This is particularly relevant for device manufacturers, mobile security teams, and incident response units that routinely extract and inspect boot images. The medium CVSS score reflects the need for user interaction, but the attack surface widens if NanaZip is integrated into automated batch-processing pipelines.

Affected systems

NanaZip versions 3.0.1000.0 through 6.0.1698.0 (inclusive on the lower bound, exclusive on the upper) are affected. This includes all stable releases prior to 6.0.1698.0 and preview versions prior to 6.5.1742.0. The vulnerability is specific to NanaZip's vbmeta parser; it does not affect standard 7-Zip distributions unless they have backported AVB support. Windows systems running affected NanaZip versions are at risk when users open or process untrusted vbmeta images or archives containing them.

Exploitability

Exploitation requires delivering a crafted vbmeta image to a user and persuading them to open it with NanaZip—a realistic social engineering scenario in firmware analysis contexts. No network access is required; the attack vector is local once the file reaches the target system. The vulnerability is not known to be actively exploited in the wild (not on the CISA KEV list), but proof-of-concept construction is likely straightforward given the integer overflow is deterministic and well-defined. Automated tooling that ingests vbmeta files without user interaction poses elevated risk if not updated.

Remediation

Update NanaZip to version 6.0.1698.0 or later (stable) or 6.5.1742.0 or later (preview). These versions include a patched AvbHandler with corrected bounds validation. Verify your installed version via NanaZip's About or Settings menu; check the official GitHub release page for Windows package availability and cryptographic signatures. If immediate patching is not feasible, disable or restrict opening of untrusted vbmeta and AVB-related file formats within NanaZip, or isolate firmware analysis workflows to a sandboxed environment.

Patch guidance

Patches are available in stable version 6.0.1698.0 and preview version 6.5.1742.0. Download from the official NanaZip repository and verify checksums. Windows users can update via the Microsoft Store if NanaZip is installed from that channel, or manually via the GitHub release page. Organizations managing multiple NanaZip installations should test patched versions in a lab environment to ensure compatibility with downstream analysis tools or scripts before broad deployment. No backward compatibility issues are reported.

Detection guidance

Monitor for suspicious crash dumps or memory access violations in NanaZip processes, particularly when processing vbmeta or AVB image files. Endpoint detection tools may flag out-of-bounds memory reads if heap overflow instrumentation is enabled. Network-based detection is not applicable. If NanaZip is integrated into automated analysis pipelines, add file-format validation upstream (e.g., verify vbmeta magic numbers and descriptor sizes before passing to NanaZip). Limit NanaZip file handler scope in enterprise environments by disabling AVB file type associations where not required.

Why prioritize this

This vulnerability warrants prompt patching for teams that routinely analyze Android firmware, device images, or security research payloads. The integer overflow is a well-understood class of defect with reliable exploitation mechanics. Although the CVSS score is medium (5.4) and active exploitation is not documented, the combination of information disclosure and denial-of-service potential, coupled with the narrow but important user base (firmware security, compliance, incident response), justifies prioritizing updates within 1–2 weeks. Lower urgency for general office environments where vbmeta processing is unlikely.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects: (1) network-capable attack vector (file delivery is frictionless), (2) low complexity (integer overflow is deterministic), (3) no privilege escalation required, (4) user interaction needed (file must be opened), and (5) scope unchanged (confined to NanaZip process). Impact is low confidentiality (heap contents may leak) and low availability (crash possible), with no integrity impact. The score does not weight the specialized nature of the affected user base or the determinism of the flaw; context-aware prioritization should account for firmware analysis criticality in your environment.

Frequently asked questions