Executive brief
NanaZip is an open-source file archiver used to compress and decompress various file formats. A security vulnerability exists where opening a specially crafted ZealFS filesystem image can cause the application to read unintended memory from the computer's stack. This could lead to the application crashing or potentially leaking sensitive internal technical information that could be used to bypass other security protections.
Technical details
A stack-based out-of-bounds read (CWE-125) exists in the ZealFS filesystem image parser within NanaZip. The vulnerability is located in the Zealfs::Open function in NanaZip.Codecs.Archive.Zealfs.cpp. An attacker-controlled BitmapSize field in the ZealFS v1 header is used as a loop bound without proper validation against the actual size of the PagesBitmap array (32 bytes). If BitmapSize is set between 33 and 255, the loop reads past the end of the stack-allocated ZEALFS_V1_HEADER structure. This can result in a denial of service (crash) or the disclosure of stack contents, such as return addresses or stack canaries, which are folded into the m_FreeSpace property. The vulnerability is triggered automatically when a user opens a malicious .zealfs file. It is fixed in version 6.0.1698.0.
Affected products
- M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0
Timeline
- 2025-02-02: other: Vulnerability introduced in version 5.0.1252.0
- 2026-04-27: advisory: GitHub advisory published by MouriNaruto
- 2026-05-12: disclosed: CVE published to NVD