CVE-2026-47224

{
  "id": "CVE-2026-47224",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T17:16:24.227",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap buffer-overflow read exists in the LVM2 physical-volume metadata parser in NanaZip (via the upstream 7-Zip LvmHandler). The vulnerability is triggered when opening a crafted LVM disk image. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0."
    },
    {
      "lang": "es",
      "value": "NanaZip es el derivado de 7-Zip destinado a la experiencia moderna de Windows. Desde la versión 3.0.1000.0 hasta antes de la versión 6.0.1698.0, existe una lectura de desbordamiento de búfer de pila en el analizador de metadatos de volumen físico LVM2 en NanaZip (a través del LvmHandler de 7-Zip ascendente). La vulnerabilidad se activa al abrir una imagen de disco LVM manipulada. Este problema ha sido parcheado en la versión estable 6.0.1698.0 y la versión preliminar 6.5.1742.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "M2Team",
          "product": "NanaZip",
          "versions": [
            {
              "version": ">= 3.0.1000.0, < 6.0.1698.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-12T20:01:31.677561Z",
          "id": "CVE-2026-47224",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qcgf-c2vp-fwjr",
      "source": "[email protected]"
    }
  ]
}