Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-47224

NanaZip: Heap buffer-overflow read in NanaZip LVM metadata CRC check

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap buffer-overflow read exists in the LVM2 physical-volume metadata parser in NanaZip (via the upstream 7-Zip LvmHandler). The vulnerability is triggered when opening a crafted LVM disk image. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

M2Team NanaZip

  • >= 3.0.1000.0, < 6.0.1698.0affected

References