NanaZip's LVM2 physical‑volume metadata parser contains a heap buffer‑overflow read that can be triggered by opening a crafted LVM disk image. The flaw allows an attacker to read data beyond the bounds of the allocated buffer, potentially exposing sensitive memory contents or causing a crash. This vulnerability is a classic out‑of‑bounds read (CWE‑125) and does not directly lead to code execution.

The issue affects M2Team NanaZip versions from 3.0.1000.0 up to, but not including, 6.0.1698.0. Versions 6.0.1698.0 and newer, as well as preview 6.5.1742.0, contain the fix and are safe to use.

With a CVSS score of 4.3 the risk is considered medium, and the EPSS score of less than 1% indicates a low likelihood of exploitation. NanaZip is a desktop application, so the attack requires local user interaction with a malicious LVM image; it therefore lacks a network exposure vector and is not listed in CISA's KEV catalog.