Executive brief
NanaZip is an open-source file archiver used to compress and decompress various file formats. A flaw in how it handles certain filesystem image files (UFS/UFS2) allows a specially crafted file to crash the application. While this does not lead to data theft or unauthorized access, it can disrupt operations by causing the software to stop responding when a user attempts to open a malicious archive.
Technical details
A null-pointer dereference exists in the UFS/UFS2 filesystem image parser within NanaZip. The vulnerability occurs because the `Open` function in `NanaZip.Codecs.Archive.Ufs.cpp` fails to verify that the root inode (inode 2) is a directory (`IFDIR`) before calling `GetAllPaths`. If a crafted image sets the root inode to a symbolic link (`IFLNK`) with a small size, the parser takes an embedded-symlink fast path that returns without populating block offsets. This results in a zero-length buffer allocation; subsequent attempts to read directory entries from this null buffer trigger a crash. The issue is fixed in version 6.0.1698.0.
Affected products
- M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0
Timeline
- 2026-04-27: advisory: Original GitHub security advisory published
- 2026-05-12: disclosed: CVE published to NVD