CVE-2026-47223

Executive Summary

CVE-2026-47223 is a heap out-of-bounds read vulnerability in NanaZip, a modern Windows fork of 7-Zip. The flaw resides in the Android Verified Boot (AVB) vbmeta image parser (AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize allows an attacker-controlled salt_len field to bypass validation. This causes CByteBuffer::CopyFrom to perform a memcpy of up to approximately 4 GiB past the end of a 64-byte buffer, leading to a heap-based buffer over-read. The vulnerability can be triggered by opening a maliciously crafted AVB vbmeta image file. The CVSS score is 5.4 (Medium), with a local attack vector and user interaction required. No public proof-of-concept (PoC) or exploit code is currently available. The vendor has released patches in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Supply Chain & Package Security

NanaZip is distributed as a Windows application, typically via GitHub releases or the Microsoft Store. The vulnerability is in the upstream 7-Zip codebase, specifically the AvbHandler component. Users should update to the latest patched version from official sources. There is no known compromise of the supply chain, but users should verify the integrity of downloaded binaries using checksums or digital signatures provided by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or convince a user to open a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Potential memory disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Potential crash or denial of service.

Threat Level: Medium. Exploitation requires user interaction, but the impact includes potential information disclosure and denial of service. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Deep Dive & Mechanics

The vulnerability is a heap out-of-bounds read in the AvbHandler component of NanaZip, which parses Android Verified Boot (AVB) vbmeta image files. The issue stems from a 32-bit unsigned integer overflow in the bounds check:

if (pos + ht.salt_len > descSize)

Here, pos and ht.salt_len are 32-bit unsigned integers. If ht.salt_len is a large value (e.g., close to UINT32_MAX), the addition pos + ht.salt_len can overflow, wrapping around to a small value. This bypasses the intended bounds check, allowing the code to proceed with a memcpy operation that reads beyond the allocated buffer.

The vulnerable code path is:

1. The parser reads the AVB vbmeta header and extracts ht.salt_len from the descriptor.
2. It allocates a 64-byte buffer (CByteBuffer) for the salt.
3. The bounds check pos + ht.salt_len > descSize is performed. Due to integer overflow, this check may pass even when ht.salt_len is extremely large.
4. CByteBuffer::CopyFrom is called, which performs a memcpy of ht.salt_len bytes from the input buffer to the 64-byte destination buffer. This results in a heap out-of-bounds read, potentially reading up to ~4 GiB of memory past the end of the source buffer.

The vulnerability can lead to:

• Information Disclosure: Reading sensitive data from heap memory.
• Denial of Service: Causing a crash due to access violation.

Vulnerable vs. Patched Code

Vulnerable Code (before 6.0.1698.0):

// AvbHandler.cpp (simplified)
UInt32 pos = ...; // current position in descriptor
UInt32 salt_len = ht.salt_len; // attacker-controlled

if (pos + salt_len > descSize) // integer overflow possible
{
    // error handling
    return;
}

CByteBuffer salt;
salt.CopyFrom(desc + pos, salt_len); // out-of-bounds read

Patched Code (6.0.1698.0 and later):

// AvbHandler.cpp (simplified)
UInt32 pos = ...;
UInt32 salt_len = ht.salt_len;

// Use 64-bit arithmetic to prevent overflow
if ((UInt64)pos + (UInt64)salt_len > (UInt64)descSize)
{
    // error handling
    return;
}

CByteBuffer salt;
salt.CopyFrom(desc + pos, salt_len);

The fix casts the operands to 64-bit before addition, preventing integer overflow and ensuring the bounds check is correct.

Exploitation & Lab Setup

Red Team

Prerequisites:

• NanaZip version 3.0.1000.0 to 6.0.1698.0 (unpatched).
• A maliciously crafted AVB vbmeta image file.

Exploitation Steps:

1. Craft Malicious AVB File: Create an AVB vbmeta image with a descriptor containing a large salt_len value (e.g., 0xFFFFFFFF). The file must be structured to pass initial parsing but trigger the overflow.
2. Deliver File: Use social engineering to convince the target to open the file with NanaZip (e.g., via email attachment or download).
3. Trigger Vulnerability: When NanaZip parses the file, the integer overflow occurs, leading to a heap out-of-bounds read. This may crash the application or leak memory.
4. Extract Data (if applicable): If the crash is controlled, an attacker might be able to read sensitive data from the heap.

Note: No public exploit code is available. This is a theoretical exploitation scenario.

Blue Team

Detection:

• Monitor for crashes of NanaZip (process name: NanaZip.exe or 7zFM.exe).
• Look for unusual memory access patterns or heap corruption errors.
• Use the detection rules provided below.

Mitigation:

• Update NanaZip to version 6.0.1698.0 or later.
• Restrict execution of NanaZip to trusted users only.
• Use application whitelisting to prevent untrusted binaries.
• Educate users about opening files from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None available – no known malicious samples)
• Process Names: NanaZip.exe, 7zFM.exe, 7zG.exe
• Network Indicators: None (local vulnerability)
• Registry Keys: None
• YARA Rule: See Detection Engineering section.

Detection Engineering

YARA Rule

rule CVE_2026_47223_NanaZip_Avb_Overread {
    meta:
        description = "Detects malicious AVB vbmeta files exploiting CVE-2026-47223"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-47223"
    strings:
        $avb_magic = "AVB0" // AVB magic bytes
        $salt_len_large = { FF FF FF 7F } // salt_len > 0x7FFFFFFF (potential overflow)
    condition:
        $avb_magic at 0 and $salt_len_large
}

Sigma Rule

title: CVE-2026-47223 NanaZip AVB Heap Overread
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2026-47223 via NanaZip crashes
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\NanaZip.exe'
            - '\7zFM.exe'
            - '\7zG.exe'
        CommandLine|contains: '.vbmeta'
    condition: selection
falsepositives:
    - Legitimate use of NanaZip with AVB files
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-47223 NanaZip AVB Heap Overread - Potential Malicious File Transfer"; flow:to_server,established; content:"AVB0"; depth:4; content:"|FF FF FF 7F|"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update NanaZip: Upgrade to stable version 6.0.1698.0 or preview version 6.5.1742.0 from the official GitHub repository or Microsoft Store.
2. Verify Integrity: After updating, verify the SHA-256 checksum of the downloaded installer against the vendor's published values.
3. Restrict File Types: If possible, block or monitor the opening of .vbmeta files in your environment.

Long-Term Measures:

• Implement application whitelisting to control which executables can run.
• Use endpoint detection and response (EDR) solutions to monitor for anomalous behavior.
• Conduct regular security awareness training to prevent social engineering attacks.
• Monitor for new CVEs related to NanaZip and 7-Zip.

Workarounds (if patching is not immediately possible):

• Disable the AVB parser by removing or renaming the AvbHandler.dll file (if present) – this may break functionality.
• Use an alternative archiving tool that does not include the vulnerable component.

Valters IT
Securing Digital Frontiers