CVE-2026-47224

CVSS Score & Metrics

Base Score

4.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L                                    

Vulnerability Description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap buffer-overflow read exists in the LVM2 physical-volume metadata parser in NanaZip (via the upstream 7-Zip LvmHandler). The vulnerability is triggered when opening a crafted LVM disk image. This issue has been patched in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Vulnerability Details

Published Date

June 12, 2026

Last Modified

June 17, 2026

CWE ID

CWE-125

Source

NVD

Vendor

M2Team

Product

NanaZip

External References

https://github.com/M2Team/NanaZip/security/advisories/GHSA-qcgf-c2vp-fwjr

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment