Is CVE-2026-47223 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47223 being exploited in the wild.

How severe is CVE-2026-47223?

Medium severity, with a CVSS score of 5.4, published 12 June 2026.

Which products and versions are affected?

M2Team NanaZip 3.0.1000.0 to 6.0.1698.0.

Is there a fix for CVE-2026-47223?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47223 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47223?

Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47223: M2Team NanaZip heap out-of-bounds read in AVB vbmeta parser

CVE-2026-47223 · Severity: medium · CVSS 5.4 · Published 2026-06-12

NanaZip is a file archiver for Windows based on 7-Zip. A security flaw in how it handles Android Verified Boot (AVB) image files allows an attacker to crash the application by providing a specially crafted file. This could lead to a denial of service where the user is unable to open certain archives or the application stops responding.

Technologies: M2Team NanaZip. Vendors: M2Team.

Quick answers

Is CVE-2026-47223 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47223 being exploited in the wild.
How severe is CVE-2026-47223?: Medium severity, with a CVSS score of 5.4, published 12 June 2026.
Which products and versions are affected?: M2Team NanaZip 3.0.1000.0 to 6.0.1698.0.
Is there a fix for CVE-2026-47223?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47223 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47223?: Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser (AvbHandler) due to a 32-bit unsigned integer overflow. Specifically, in the bounds check 'pos + ht.salt_len > descSize', an attacker can provide a large 'salt_len' value that causes the addition to wrap around to a small value, bypassing the validation. This leads to a 'memcpy' operation in 'CByteBuffer::CopyFrom' that attempts to read up to 4 GiB from a heap buffer that is typically only 64 KiB. While the primary impact is a deterministic application crash (DoS) upon hitting unmapped memory, it could theoretically lead to limited information disclosure of adjacent heap memory. The vulnerability is reachable via network delivery of a crafted file and requires minimal user interaction (opening the file). The issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Affected products

M2Team NanaZip 3.0.1000.0 to 6.0.1698.0

Timeline

2026-05-18: advisory: GitHub Security Advisory published by M2Team
2026-06-12: disclosed: CVE published to NVD

References

https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.