CVE-2026-47223

Name of the Vulnerable Software and Affected Versions NanaZip versions 3.0.1000.0 through 6.0.1697.0

Description A heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser via the upstream 7-Zip AvbHandler. A 32-bit unsigned integer overflow occurs during the bounds check pos + ht.salt len > descSize, allowing an attacker-controlled salt len field to bypass validation. This leads to the CByteBuffer::CopyFrom() function performing a memcpy operation up to approximately 4 GiB beyond the end of the buffer.

Recommendations Update to version 6.0.1698.0 or version 6.5.1742.0.