A heap out‑of‑bounds read was discovered in NanaZip’s Android Verified Boot (AVB) vbmeta image parser, which may be triggered by an attacker‑controlled value_num_bytes field that underflows during bounds checking. The resulting unsigned integer underflow allows the AddNameToString routine to read memory up to ~4 GiB past a 64 KiB heap buffer, causing a deterministic crash when the application opens a crafted .avb or .img file. This crash results in denial of service and is associated with CWE‑125 and CWE‑191 weaknesses.

The vulnerability affects the NanaZip product produced by M2Team, specifically versions ranging from 3.0.1000.0 through the pre‑6.0.1698.0 releases. The stable 6.0.1698.0 release and preview 6.5.1742.0 contain the fix. NanaZip is a derivative of 7‑Zip and provides a modern Windows archive utility.

With a CVSS base score of 5.4, this issue is considered medium severity. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring the attacker to supply a crafted .avb or .img file that the user or a script opens with NanaZip; no remote code execution or privilege escalation is possible. The deterministic crash provides an observable denial‑of‑service effect but does not expose destructive memory corruption or data exfiltration.