Quick answers
- Is CVE-2026-47222 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47222 being exploited in the wild.
- How severe is CVE-2026-47222?
- Medium severity, with a CVSS score of 5.4, published 12 June 2026.
- Which products and versions are affected?
- M2Team NanaZip 3.0.1000.0 to before 6.0.1698.0.
- Is there a fix for CVE-2026-47222?
- A patch was published on 2026-06-12: Fix available in version 6.0.1698.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-47222 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-47222?
- Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser (AvbHandler) due to an unsigned integer underflow. When parsing property descriptors, the application fails to properly validate the 'value_num_bytes' field against the remaining buffer size. Specifically, if 'pos' equals 'descSize', a subtraction operation (descSize - pos - 1) results in an underflow to 0xFFFFFFFF. This causes the 'AddNameToString' function to read up to 4 GiB past the end of a 64 KiB heap buffer, leading to an access violation and process crash. The vulnerability is reachable via the IInArchive::Open() interface when a user attempts to open a malicious .avb or .img file. The issue is patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
Affected products
- M2Team NanaZip 3.0.1000.0 to before 6.0.1698.0
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published by M2Team
- 2026-06-12: disclosed: CVE published to NVD
- 2026-06-12: patched: Fix available in version 6.0.1698.0