CVE-2026-47224: NanaZip Buffer Overflow Vulnerability

CVE-2026-47224 Overview

CVE-2026-47224 is a heap buffer over-read vulnerability in NanaZip, the 7-Zip derivative for modern Windows. The flaw resides in the Logical Volume Manager 2 (LVM2) physical-volume metadata parser inherited from the upstream 7-Zip LvmHandler. Versions from 3.0.1000.0 up to (but not including) 6.0.1698.0 are affected. An attacker triggers the issue by convincing a user to open a crafted LVM disk image. The vulnerability is tracked under [CWE-125] Out-of-Bounds Read and has been patched in stable release 6.0.1698.0 and preview release 6.5.1742.0.

Critical Impact
Opening a malicious LVM disk image causes an out-of-bounds read in the LVM2 parser, leading to process crashes or limited memory disclosure within the NanaZip process.

Affected Products

NanaZip stable versions 3.0.1000.0 through versions prior to 6.0.1698.0
NanaZip preview versions prior to 6.5.1742.0
Upstream 7-Zip LvmHandler component used to parse LVM2 physical-volume metadata

Discovery Timeline

2026-06-12 - CVE-2026-47224 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47224

Vulnerability Analysis

The vulnerability is a heap buffer over-read in the LVM2 physical-volume metadata parser within NanaZip. NanaZip inherits its archive and disk-image parsing logic from upstream 7-Zip, including the LvmHandler responsible for interpreting LVM2 structures. When the parser processes a crafted LVM disk image, it reads beyond the allocated heap buffer that holds metadata fields. The over-read returns adjacent heap memory to the parsing logic, which can cause access violations or expose process memory content. The flaw is classified as [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is missing or insufficient bounds validation when the LVM2 parser dereferences offsets and length fields embedded in attacker-controlled physical-volume metadata. The parser trusts size and offset values from the disk image without confirming they remain within the bounds of the allocated buffer. A malformed metadata header therefore drives reads past the end of the buffer.

Attack Vector

Exploitation requires user interaction. A user must open a crafted .img, .vmdk, or similar disk-image file inside NanaZip. The image can be delivered through email attachments, drive-by downloads, USB media, or shared network locations. Because the attack vector is classified as network-reachable with required user interaction, social-engineering delivery is the most likely path. Successful exploitation impacts availability and may produce limited information disclosure, but the public advisory does not indicate code execution. Refer to the GitHub Security Advisory GHSA-qcgf-c2vp-fwjr for additional technical context.

Detection Methods for CVE-2026-47224

Indicators of Compromise

Unexpected crashes of NanaZip.exe or NanaZipC.exe shortly after opening a disk-image file
Windows Error Reporting (WER) entries referencing access violations within the NanaZip or 7-Zip LvmHandler parsing code path
Disk image files with .img, .lvm, .vmdk, or similar extensions arriving via email or download from untrusted origins

Detection Strategies

Monitor endpoint telemetry for NanaZip processes terminating with exception codes such as 0xC0000005 after handling archive or disk-image files
Hunt for file-write events of disk-image extensions to user download or temp directories, followed immediately by NanaZip child processes
Inspect application crash dumps for stack frames containing LvmHandler or LVM2 metadata-parsing symbols

Monitoring Recommendations

Track installed NanaZip versions across the fleet and alert on any version below 6.0.1698.0
Log file-open and file-association events for archive utilities to correlate user interaction with parser crashes
Enable and centrally collect Windows Error Reporting data from endpoints that use NanaZip for triage

How to Mitigate CVE-2026-47224

Immediate Actions Required

Upgrade NanaZip to stable version 6.0.1698.0 or preview version 6.5.1742.0 or later on all affected endpoints
Block or quarantine inbound LVM and disk-image attachments at the email gateway until patching is complete
Instruct users not to open disk-image files received from unverified sources

Patch Information

The NanaZip maintainers fixed the LVM2 parser in stable release 6.0.1698.0 and preview release 6.5.1742.0. Patch details and vendor guidance are published in the GitHub Security Advisory GHSA-qcgf-c2vp-fwjr. Apply the update through the Microsoft Store, GitHub release page, or your enterprise software-distribution channel.

Workarounds

Avoid opening LVM2 physical-volume images or untrusted disk images with NanaZip until the update is applied
Restrict file associations so disk-image formats do not open in NanaZip by default on managed endpoints
Use application-control policies to permit only the patched NanaZip version to execute

bash

# Verify the installed NanaZip version on Windows endpoints
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version

# Example output should show Version 6.0.1698.0 or higher
# Remove vulnerable versions if upgrade is not yet possible
Get-AppxPackage -Name "*NanaZip*" | Where-Object { $_.Version -lt "6.0.1698.0" } | Remove-AppxPackage