M2Team Nanazip vulnerabilities

CVE-2026-27114 [HIGH] CWE-835 CVE-2026-27114: NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to version 6.0.1630 NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.

CVE-2026-55780 [LOW] CWE-248 CVE-2026-55780: NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, Nan NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause

CVE-2026-54616 [HIGH] CWE-125 CVE-2026-54616: NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 un NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error

CVE-2026-44215 [HIGH] CWE-787 CVE-2026-44215: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocati

CVE-2026-42446 [HIGH] CWE-125 CVE-2026-42446: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-b NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the

CVE-2026-26282 [MEDIUM] CWE-126 CVE-2026-26282: NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630. NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single File` bundle header parser due to missing bounds check. Opening a crafted file with NanaZip causes a crash or leaks heap data to the user. Version 6.0.1630.0 patches the issue.

CVE-2026-27711 [MEDIUM] CWE-125 CVE-2026-27711: NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.163 NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted `.ufs/.ufs2/.img` file to trigger out-of-bounds memory access during archive open/listing. The bug is reachable via normal user file-open flow and can cause

CVE-2026-27709 [MEDIUM] CWE-125 CVE-2026-27709: NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.163 NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s `.NET Single File Application` parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed `RelativePathLength` so the parser constructs a `std::string` from memory beyond

CVE-2026-47223 [MEDIUM] CWE-125 CVE-2026-47223: NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). A 32-bit unsigned integer overflow in the bounds check pos + ht.salt_len > descSize al

CVE-2026-47222 [MEDIUM] CWE-125 CVE-2026-47222: NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot (AVB) vbmeta image parser in NanaZip (via the upstream 7-Zip AvbHandler). An unsigned integer underflow in a bounds check allows an attacker-controlled value_nu

CVE-2026-42445 [MEDIUM] CWE-674 CVE-2026-42445: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recurs NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle caus

CVE-2026-42355 [MEDIUM] CWE-674 CVE-2026-42355: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recurs NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhaust

CVE-2026-42442 [MEDIUM] CWE-476 CVE-2026-42442: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer derefer NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats th

CVE-2026-42444 [MEDIUM] CWE-770 CVE-2026-42444: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vu NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then ite

CVE-2026-42443 [MEDIUM] CWE-369 CVE-2026-42443: NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-z NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero. The parser uses this attacker-controlled value

CVE-2026-27014 [MEDIUM] CWE-674 CVE-2026-27014: NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630. NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and deeply nested directories cause unbounded recursion (stack overflow) in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.

CVE-2026-47224 [MEDIUM] CWE-125 CVE-2026-47224: NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap buffer-overflow read exists in the LVM2 physical-volume metadata parser in NanaZip (via the upstream 7-Zip LvmHandler). The vulnerability is triggered when opening a crafted LVM disk image. This issue has been patch

CVE-2026-27710 [MEDIUM] CWE-191 CVE-2026-27710: NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.163 NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a denial-of-service vulnerability exists in NanaZip’s `.NET Single File Application` parser. A crafted bundle can force an integer underflow in header-size calculation and trigger an unbounded memory allocation attempt during archi

CVE-2026-55781 [LOW] CWE-400 CVE-2026-55781: NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, Nan NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fs_fsize fragment size, allowing attacker-controlled 32-bit fields to flow into indirec

CVE-2026-55782 [LOW] CWE-400 CVE-2026-55782: NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, Nan NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can f