Executive brief
NanaZip is a popular file archiving utility for Windows. A security flaw in how it handles Android Verified Boot (AVB) image files allows an attacker to cause the application to crash by providing a specially crafted .avb or .img file. This could lead to a denial of service, preventing users from opening or managing their archives.
Technical details
A heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser (AvbHandler) due to an unsigned integer underflow. When parsing property descriptors, the application fails to properly validate the 'value_num_bytes' field against the remaining buffer size. Specifically, if 'pos' equals 'descSize', a subtraction operation (descSize - pos - 1) results in an underflow to 0xFFFFFFFF. This causes the 'AddNameToString' function to read up to 4 GiB past the end of a 64 KiB heap buffer, leading to an access violation and process crash. The vulnerability is reachable via the IInArchive::Open() interface when a user attempts to open a malicious .avb or .img file. The issue is patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.
Affected products
- M2Team NanaZip 3.0.1000.0 to before 6.0.1698.0
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published by M2Team
- 2026-06-12: disclosed: CVE published to NVD
- 2026-06-12: patched: Fix available in version 6.0.1698.0