CVE-2026-47222

Name of the Vulnerable Software and Affected Versions NanaZip versions 3.0.1000.0 through 6.0.1697.0

Description A heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser via the upstream 7-Zip AvbHandler. An unsigned integer underflow in a bounds check allows an attacker-controlled value num bytes field to pass validation, causing the AddNameToString() function to read up to approximately 4 GiB past the end of a 64 KiB heap buffer. This results in a deterministic crash and denial of service when opening a specially crafted .avb or .img file.

Recommendations Update to version 6.0.1698.0 or preview version 6.5.1742.0.