PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47223 M2Team CVE debrief

CVE-2026-47223 is a medium-severity vulnerability in NanaZip, a 7-Zip derivative for modern Windows experiences. A heap out-of-bounds read issue exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). The vulnerability is caused by a 32-bit unsigned integer overflow in the bounds check, allowing an attacker-controlled salt_len field to bypass validation. This causes CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64. The affected versions are from 3.0.1000.0 to before 6.0.1698.0. The issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Vendor
M2Team
Product
NanaZip
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Users of NanaZip versions 3.0.1000.0 to before 6.0.1698.0 should update to the patched versions to prevent potential exploitation.

Technical summary

The vulnerability exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip. A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation. This causes CByteBuffer::CopyFrom to memcpy up to ~4 GiB past the end of a 64.

Defensive priority

Medium

Recommended defensive actions

  • Update NanaZip to version 6.0.1698.0 or later
  • Use a supported version of NanaZip

Evidence notes

The CVE-2026-47223 vulnerability has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47223 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47223

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47223 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47223

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.