CVE-2026-54616: NanaZip SquashfsHandler heap out-of-bounds read and information disclosure

CVE-2026-54616 · Severity: high · CVSS 7.1 · Published 2026-08-20

NanaZip is a Windows archive extraction tool used to open compressed files including Squashfs archives. A malformed archive file can trigger a heap memory read error during extraction, allowing an attacker to leak sensitive data from the application's memory or crash the program. An attacker can craft a malicious archive file that, when extracted by a user, exposes adjacent heap contents in the output file or causes the extraction process to fail.

Technologies: M2Team NanaZip. Vendors: M2Team.

Quick answers

Is CVE-2026-54616 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54616 being exploited in the wild.
How severe is CVE-2026-54616?
High severity, with a CVSS score of 7.1, published 20 August 2026.
Which products and versions are affected?
M2Team NanaZip 1.0.88.0 to 6.0.1698.0.
Is there a fix for CVE-2026-54616?
A patch was published on 2026-08-20: Fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54616 attacked?
It is attacked with local access.
Am I affected by CVE-2026-54616?
Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Lz4Decode function within SquashfsHandler.cpp, which fails to properly validate error return values from the LZ4_decompress_safe function. When decompression fails, the function receives a negative error value but only checks for zero, allowing the negative int to be unsafely converted to an unsigned SizeT value. This corrupted size is later truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-controlled inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can cause memcpy to read beyond the _cachedBlock heap allocation, enabling information disclosure or process crash. The vulnerability affects versions 1.0.88.0 through 6.0.1698.0 (stable) and up to 6.5.1742.0 (preview), and is fixed in those releases.

Affected products

  • M2Team NanaZip 1.0.88.0 to 6.0.1698.0

Timeline

  • 2026-08-20: disclosed
  • 2026-08-20: patched: Fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.