Is CVE-2026-42446 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42446 being exploited in the wild.

How severe is CVE-2026-42446?

Medium severity, with a CVSS score of 4.4, published 12 May 2026.

Which products and versions are affected?

M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0.

Is there a fix for CVE-2026-42446?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42446 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-42446?

Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42446: M2Team NanaZip stack out-of-bounds read in ZealFS parser

CVE-2026-42446 · Severity: medium · CVSS 4.4 · Published 2026-05-12

NanaZip is an open-source file archiver used to compress and decompress various file formats. A security vulnerability exists where opening a specially crafted ZealFS filesystem image can cause the application to read unintended memory from the computer's stack. This could lead to the application crashing or potentially leaking sensitive internal technical information that could be used to bypass other security protections.

Technologies: M2Team NanaZip. Vendors: M2Team.

Quick answers

Is CVE-2026-42446 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42446 being exploited in the wild.
How severe is CVE-2026-42446?: Medium severity, with a CVSS score of 4.4, published 12 May 2026.
Which products and versions are affected?: M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0.
Is there a fix for CVE-2026-42446?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42446 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-42446?: Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based out-of-bounds read (CWE-125) exists in the ZealFS filesystem image parser within NanaZip. The vulnerability is located in the Zealfs::Open function in NanaZip.Codecs.Archive.Zealfs.cpp. An attacker-controlled BitmapSize field in the ZealFS v1 header is used as a loop bound without proper validation against the actual size of the PagesBitmap array (32 bytes). If BitmapSize is set between 33 and 255, the loop reads past the end of the stack-allocated ZEALFS_V1_HEADER structure. This can result in a denial of service (crash) or the disclosure of stack contents, such as return addresses or stack canaries, which are folded into the m_FreeSpace property. The vulnerability is triggered automatically when a user opens a malicious .zealfs file. It is fixed in version 6.0.1698.0.

Affected products

M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0

Timeline

2025-02-02: other: Vulnerability introduced in version 5.0.1252.0
2026-04-27: advisory: GitHub advisory published by MouriNaruto
2026-05-12: disclosed: CVE published to NVD

References

https://github.com/M2Team/NanaZip/security/advisories/GHSA-4c79-hfr4-mqv9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.