Heap Buffer Overflow in NanaZip AVB Hash Tree Descriptor Parser (GHSL-2026-127)

Vulnerability Overview Vulnerability Name: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow (GHSL-2026-127) Description: This vulnerability exists in NanaZip's AVB hashtree descriptor parser, allowing heap out-of-bounds reads through a 32-bit unsigned integer overflow. Specifically, the check allows attackers to control the field to bypass validation, causing to use to read up to 4 GiB of memory, exceeding the 64 KiB heap buffer. This results in a deterministic crash (Denial of Service). Scope Affected Versions: NanaZip >=3.0.1000.0 Fixed Versions: - Stable: >= 6.0.1698.0 - Preview: >= 6.5.1742.0 CVSS Score: 5.4 / 10 (Medium) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: Low Remediation 1. Disable the Extractor: Consider disabling the extractor, as it is not yet ready for use. 2. Upgrade Version: Upgrade to the fixed version (Stable >= 6.0.1698.0 or Preview >= 6.5.1742.0). 3. Code Fix: Upgrade the boundary check to 64-bit arithmetic. For example: Or use the subtraction form (since is an invariant): Apply similarly to , , and . POC Code Verification The vulnerability can be verified when NanaZip is compiled with AddressSanitizer (ReleaseAsan configuration): Credit These vulnerabilities were discovered and reported by JarLob (Jaroslav Lobavskyk), a member of the GHSL team. Disclosure Policy This report is subject to a 90-day disclosure period, as outlined in the coordinated disclosure policy.

Goal Reached Thanks to every supporter — we hit 100%!

Heap Buffer Overflow in NanaZip AVB Hash Tree Descriptor Parser (GHSL-2026-127)

More from this source