NanaZip, a 7‑Zip derivative for Windows, contains a 32‑bit unsigned integer overflow in the Android Verified Boot (AVB) vbmeta image parser. The overflow occurs in the bounds check pos + ht.salt_len > descSize, allowing an attacker-controlled salt_len field to bypass validation. Consequently, CByteBuffer::CopyFrom may memcpy up to roughly 4 GiB beyond the intended heap buffer, resulting in an out-of-bounds read that can reveal arbitrary memory contents. This flaw can potentially expose sensitive information and, in worst-case scenarios, lead to a denial-of-service through a crash.

M2Team’s NanaZip versions from 3.0.1000.0 up to, but not including, 6.0.1698.0 are vulnerable. The issue was fixed in stable release 6.0.1698.0 and preview 6.5.1742.0, so any installation of NanaZip older than those two releases is impacted.

The CVSS base score of 5.4 indicates moderate severity, while the EPSS score of less than 1 % conveys a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious vbmeta image or otherwise control the salt_len field, which suggests a local or privileged attack surface rather than a remote trigger. Nonetheless, the potential for memory disclosure warrants prompt remediation.