CVE-2026-47224

Executive Summary

CVE-2026-47224 is a heap buffer-overflow read vulnerability in NanaZip, a modern Windows fork of 7-Zip. The flaw resides in the LVM2 physical-volume metadata parser (LvmHandler) and is triggered when a user opens a specially crafted LVM disk image. An attacker can exploit this to cause a denial-of-service (application crash) or potentially leak sensitive heap memory. The vulnerability affects versions 3.0.1000.0 through 6.0.1698.0 (exclusive). The patch was released in stable version 6.0.1698.0 and preview version 6.5.1742.0. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

NanaZip is distributed via the Microsoft Store and GitHub releases. Users should verify the digital signature of the installer and ensure they download from the official repository (https://github.com/M2Team/NanaZip). The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a standalone Windows application.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must open the crafted LVM image)
• Scope: Unchanged
• Confidentiality Impact: Low (potential heap memory leak)
• Integrity Impact: None
• Availability Impact: Low (application crash)

The low EPSS score (0.0%) indicates that exploitation is not currently widespread, but the vulnerability is still a risk for users handling untrusted disk images.

Deep Dive & Mechanics

The vulnerability is a heap buffer-overflow read in the LVM2 physical-volume metadata parser. When NanaZip opens an LVM disk image, the LvmHandler component reads metadata from the image. The parser fails to properly validate the size of a metadata field before reading it into a heap buffer. By crafting an LVM image with an oversized metadata value, an attacker can cause the parser to read beyond the allocated buffer, leading to a heap buffer-overflow read.

This can result in:

• Denial of Service: The application crashes due to an access violation.
• Information Disclosure: Adjacent heap memory (potentially containing sensitive data) may be read and exposed to the attacker.

The vulnerability is similar to classic 7-Zip archive parsing flaws, where malformed headers cause out-of-bounds reads.

Vulnerable vs. Patched Code

The vulnerable code is in the LvmHandler component, specifically in the function that parses LVM2 physical-volume metadata. The patch (in version 6.0.1698.0) adds a bounds check before reading the metadata field.

Vulnerable Code (simplified):

// No size validation before memcpy
char *metadata = malloc(metadata_size);
memcpy(metadata, input_data, metadata_size); // Potential overflow if metadata_size > buffer

Patched Code (simplified):

// Added bounds check
if (metadata_size > MAX_METADATA_SIZE) {
    return ERROR_INVALID_DATA;
}
char *metadata = malloc(metadata_size);
memcpy(metadata, input_data, metadata_size);

The exact patch can be found in the NanaZip repository commit history.

Exploitation & Lab Setup

Red Team (Offensive)

No public exploit code is available. To test the vulnerability, an attacker would need to craft a malicious LVM disk image with an oversized metadata field. The following steps outline a potential approach:

1. Create a base LVM image: Use dd to create a raw disk image and lvm2 tools to add physical volume metadata.
2. Modify the metadata: Use a hex editor to increase the metadata size field in the LVM header beyond the actual buffer size.
3. Deliver the image: Send the crafted image to the victim via email, download, or removable media.
4. Trigger the vulnerability: The victim opens the image in NanaZip, causing a heap buffer-overflow read.

Lab Setup:

• Victim: Windows 10/11 with NanaZip 3.0.1000.0 to 6.0.1697.0 installed.
• Attacker: Linux or Windows with a hex editor and LVM tools.
• Tool: qemu-img or dd to create disk images, hexdump to modify.

Blue Team (Defensive)

• Monitor for crashes: Use Windows Event Logs to detect NanaZip crashes (Event ID 1000 for application errors).
• File scanning: Deploy YARA rules (see Detection Engineering) to scan for malicious LVM images.
• User education: Warn users not to open untrusted disk images from unknown sources.
• Patch management: Ensure NanaZip is updated to version 6.0.1698.0 or later.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): No known malicious samples exist publicly.
• File Patterns: LVM disk images with abnormally large metadata size fields (e.g., > 4KB).
• Process Behavior: NanaZip.exe crashes with access violation reading address 0x????????.
• Network: No network indicators (vulnerability is local file-based).

Detection Engineering

YARA Rule

rule CVE_2026_47224_LVM_Overflow {
    meta:
        description = "Detects crafted LVM images exploiting CVE-2026-47224"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $lvm_magic = "LABELONE" nocase
        $lvm_metadata = "metadata" nocase
    condition:
        $lvm_magic at 0 and
        // Check for oversized metadata size field (offset 0x200, 4 bytes)
        uint32(0x200) > 4096
}

Sigma Rule

title: NanaZip LVM Heap Overflow Crash
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects NanaZip crashes due to heap buffer overflow in LVM parser
author: Valters IT
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        ApplicationName: 'NanaZip.exe'
        FaultingModule: 'LvmHandler.dll'
    condition: selection
falsepositives:
    - Legitimate corrupted LVM images
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-47224 LVM Image Download"; flow:to_client; file.name:/.*\.(lvm|img|iso)/; file.size:>1048576; content:"LABELONE"; offset:0; depth:8; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update NanaZip to version 6.0.1698.0 (stable) or 6.5.1742.0 (preview) from the official GitHub repository or Microsoft Store.
2. Workaround: Do not open LVM disk images from untrusted sources. Use alternative tools (e.g., 7-Zip 24.09 or later) if NanaZip cannot be updated.
3. Long-term: Enable Windows Defender Exploit Guard to mitigate heap-based exploits. Monitor for future patches from the NanaZip project.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2026-47224