CVE-2026-47224 MEDIUM

CVE-2026-47224: NanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC check

Vendor M2Team
Product NanaZip
Weakness CWE-125
Published June 12, 2026
Last update June 12, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap buffer-overflow read exists in the LVM2 physical-volume metadata parser in NanaZip (via the upstream 7-Zip LvmHandler). The vulnerability is triggered when opening a crafted LVM disk image. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Key dates

02Disclosure timeline

June 12, 2026 CVE published
June 12, 2026 Record updated