Executive brief
NanaZip, an open-source file archiving utility, is vulnerable to a denial-of-service attack when processing specially crafted filesystem images. An attacker can create a tiny, 44-byte file that, when opened, forces the application to attempt billions of memory allocations. This results in extreme memory exhaustion, potentially causing the user's system to become unresponsive or crash.
Technical details
A denial-of-service vulnerability exists in the littlefs filesystem image parser within NanaZip due to improper validation of the 'BlockCount' field in the superblock. The handler's Open method reads this value directly from the attacker-controlled image without verifying it against the actual file size or an upper-bound limit. An attacker can provide a crafted 44-byte image with a BlockCount set to 0xFFFFFFFF, causing the application to enter a loop that performs approximately 4 billion heap allocations. This leads to massive memory consumption (hundreds of GiB), driving the system into swap and causing a persistent hang or crash. The vulnerability is triggered during the archive opening process (IInArchive::Open) and is fixed in version 6.0.1698.0.
Affected products
- M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published by M2Team
- 2026-05-12: disclosed: CVE published to NVD