CVE-2026-47224: NanaZip LVM Heap Buffer Over-Read Vulnerability – MEDIUM Severity

Technical summary

CVE-2026-47224 is a heap buffer over-read vulnerability in the LVM2 physical-volume metadata parser integrated into NanaZip via the upstream 7-Zip LvmHandler component. The flaw exists in versions 3.0.1000.0 through 6.0.1697.0 and is triggered during the parsing of crafted LVM disk image structures. Because the vulnerability results in an out-of-bounds read rather than write, it is classified as a denial-of-service and potential information-disclosure vector. The CVSS 3.1 score of 4.3 (MEDIUM) reflects low attack complexity and no special privileges required, but impact limited to availability and confidentiality with no integrity compromise.

Business impact

The primary business risk is operational disruption: users attempting to open or scan untrusted LVM disk images could experience application crashes, interrupting backup and recovery workflows. Organizations relying on NanaZip for routine archive and disk-image handling should treat this as a stability concern. Secondary risk is information leakage if heap memory contains sensitive data (encryption keys, credentials, plaintext files) that could be exfiltrated through memory corruption techniques. For enterprises where NanaZip is embedded in automated storage-analysis or forensic pipelines, unpatched versions could introduce unexpected failures or data-handling gaps.

Affected systems

NanaZip versions 3.0.1000.0 through 6.0.1697.0 running on Windows are affected. The vendor advisory confirms patching in stable version 6.0.1698.0 and preview version 6.5.1742.0. No specific Windows editions or architectures are excluded; all Windows systems running vulnerable NanaZip builds are at risk if users interact with untrusted LVM disk images.

Exploitability

Exploitation requires no authentication or special privileges; an attacker must craft a malicious LVM disk image and trick or socially engineer a user into opening it with vulnerable NanaZip. Given that file-opening is routine behavior and LVM disk images may be encountered in legitimate contexts (virtual machine images, backup archives, forensic acquisitions), the attack surface is credible. However, the attacker cannot execute arbitrary code or write to memory; they can only trigger a crash or information read. Autonomous, user-agnostic exploitation is not feasible. No known public exploits or active exploitation in the wild have been reported at time of publication.

Remediation

Immediate remediation is to update NanaZip to version 6.0.1698.0 (stable) or 6.5.1742.0 (preview) or later. No workarounds mitigate the vulnerability entirely, but users can reduce exposure by avoiding the opening of untrusted or suspicious LVM disk images and restricting NanaZip file associations to trusted sources only. Organizations should prioritize patching systems where NanaZip is part of critical backup, archive, or forensic workflows.

Patch guidance

Download and install NanaZip version 6.0.1698.0 or higher from the official source. If using preview builds, version 6.5.1742.0 or later addresses the vulnerability. Verify the version number via Help > About in NanaZip after installation. For organizations with managed deployments, push updates via software distribution platforms; for individual users, Windows Package Manager (winget) or the Microsoft Store typically offer streamlined update paths. Test patched versions in non-critical environments before broad rollout to confirm compatibility with custom scripts or integrations.

Detection guidance

Look for NanaZip processes opening or parsing LVM disk image files (.lvm, .img, .vhd, or similar) in your environment. Monitor application crash logs and event viewer entries for NanaZip exceptions or access violations (STATUS_HEAP_CORRUPTION, STATUS_ACCESS_VIOLATION). Network detection is unlikely unless LVM images are fetched from remote sources; prioritize endpoint detection and logging of file-open events for suspicious disk images. Forensic analysis of crashes should examine the call stack for LvmHandler or metadata-parser routines.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), prioritization should account for usage context. If NanaZip is confined to isolated lab systems or personal use with trusted archives, remediation can be deferred to a standard patch cycle. However, if NanaZip is part of enterprise backup, disaster-recovery, or forensic tooling where untrusted disk images are frequently processed (e.g., customer backup restoration, incident response), patches should be applied within 2–4 weeks to reduce operational risk and unplanned downtime.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) network-adjacent attack vector (AV:N) because LVM images can be obtained remotely, (2) low attack complexity (AC:L) requiring no special conditions beyond crafting a malicious disk image, (3) no privileges required (PR:N) and no user interaction beyond opening a file (UI:R), (4) limited impact—availability degradation (crash) and potential confidentiality loss (memory read) but no integrity compromise. The absence of active exploitation in the wild and the requirement for user interaction (opening a file) keep the score moderate rather than high.

Frequently asked questions