Quick answers
- Is CVE-2026-42444 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42444 being exploited in the wild.
- How severe is CVE-2026-42444?
- Low severity, with a CVSS score of 3.3, published 12 May 2026.
- Which products and versions are affected?
- M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0.
- Is there a fix for CVE-2026-42444?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-42444 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-42444?
- Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in the littlefs filesystem image parser within NanaZip due to improper validation of the 'BlockCount' field in the superblock. The handler's Open method reads this value directly from the attacker-controlled image without verifying it against the actual file size or an upper-bound limit. An attacker can provide a crafted 44-byte image with a BlockCount set to 0xFFFFFFFF, causing the application to enter a loop that performs approximately 4 billion heap allocations. This leads to massive memory consumption (hundreds of GiB), driving the system into swap and causing a persistent hang or crash. The vulnerability is triggered during the archive opening process (IInArchive::Open) and is fixed in version 6.0.1698.0.
Affected products
- M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published by M2Team
- 2026-05-12: disclosed: CVE published to NVD