CVE-2026-47223

{
  "id": "CVE-2026-47223",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T18:16:34.640",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation, causing CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0."
    },
    {
      "lang": "es",
      "value": "NanaZip es el derivado de 7-Zip destinado a la experiencia moderna de Windows. Desde la versión 3.0.1000.0 hasta antes de la versión 6.0.1698.0, existe una lectura fuera de límites en el heap en el analizador de imágenes vbmeta de Android Verified Boot (AVB) en NanaZip (a través del AvbHandler de 7-Zip ascendente). Un desbordamiento de entero sin signo de 32 bits en la comprobación de límites pos + ht.salt_len > descSize permite que un campo salt_len controlado por el atacante omita la validación, lo que provoca que CByteBuffer::CopyFrom realice un memcpy de hasta ~4 GiB pasando el final de un 64. Este problema ha sido parcheado en la versión estable 6.0.1698.0 y la versión preliminar 6.5.1742.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "M2Team",
          "product": "NanaZip",
          "versions": [
            {
              "version": ">= 3.0.1000.0, < 6.0.1698.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-13T03:22:21.785257Z",
          "id": "CVE-2026-47223",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}