# CVE-2026-42446: M2Team NanaZip stack out-of-bounds read in ZealFS parser

Source: https://junglewise.ai/threats/cve-2026-42446-m2team-nanazip-stack-out-of-bounds-read-in-zealfs-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42446 · Severity: medium · CVSS 4.4 · Published 2026-05-12

NanaZip is an open-source file archiver used to compress and decompress various file formats. A security vulnerability exists where opening a specially crafted ZealFS filesystem image can cause the application to read unintended memory from the computer's stack. This could lead to the application crashing or potentially leaking sensitive internal technical information that could be used to bypass other security protections.

Technologies: [M2Team NanaZip](https://junglewise.ai/threats/technologies/nanazip). Vendors: [M2Team](https://junglewise.ai/threats/vendors/m2team).

## Quick answers

**Is CVE-2026-42446 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42446 being exploited in the wild.

**How severe is CVE-2026-42446?** Medium severity, with a CVSS score of 4.4, published 12 May 2026.

**Which products and versions are affected?** M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0.

**Is there a fix for CVE-2026-42446?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42446 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-42446?** Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based out-of-bounds read (CWE-125) exists in the ZealFS filesystem image parser within NanaZip. The vulnerability is located in the Zealfs::Open function in NanaZip.Codecs.Archive.Zealfs.cpp. An attacker-controlled BitmapSize field in the ZealFS v1 header is used as a loop bound without proper validation against the actual size of the PagesBitmap array (32 bytes). If BitmapSize is set between 33 and 255, the loop reads past the end of the stack-allocated ZEALFS_V1_HEADER structure. This can result in a denial of service (crash) or the disclosure of stack contents, such as return addresses or stack canaries, which are folded into the m_FreeSpace property. The vulnerability is triggered automatically when a user opens a malicious .zealfs file. It is fixed in version 6.0.1698.0.

## Affected products

- M2Team NanaZip 5.0.1252.0 to before 6.0.1698.0

## Timeline

- 2025-02-02: other: Vulnerability introduced in version 5.0.1252.0
- 2026-04-27: advisory: GitHub advisory published by MouriNaruto
- 2026-05-12: disclosed: CVE published to NVD

## References

- [https://github.com/M2Team/NanaZip/security/advisories/GHSA-4c79-hfr4-mqv9](https://github.com/M2Team/NanaZip/security/advisories/GHSA-4c79-hfr4-mqv9)

## Related threats

- [NanaZip SquashfsHandler heap out-of-bounds read and information disclosure](https://junglewise.ai/threats/cve-2026-54616-nanazip-squashfshandler-heap-out-of-bounds-read-and-information)
- [M2Team NanaZip NULL pointer dereference in NanaZip.Codecs archive handlers](https://junglewise.ai/threats/cve-2026-55783-m2team-nanazip-null-pointer-dereference-in-nanazip-codecs-archive)
- [M2Team NanaZip uncontrolled memory allocation in WebAssembly handler](https://junglewise.ai/threats/cve-2026-55782-m2team-nanazip-uncontrolled-memory-allocation-in-webassembly)
- [M2Team NanaZip memory exhaustion in UFS and FFS image handler](https://junglewise.ai/threats/cve-2026-55781-m2team-nanazip-memory-exhaustion-in-ufs-and-ffs-image-handler)
- [M2Team NanaZip uncaught exception in .NET single-file handler](https://junglewise.ai/threats/cve-2026-55780-m2team-nanazip-uncaught-exception-in-net-single-file-handler)