Executive brief
NanaZip is a Windows archive extraction tool used to open compressed files including Squashfs archives. A malformed archive file can trigger a heap memory read error during extraction, allowing an attacker to leak sensitive data from the application's memory or crash the program. An attacker can craft a malicious archive file that, when extracted by a user, exposes adjacent heap contents in the output file or causes the extraction process to fail.
Technical details
The vulnerability exists in the Lz4Decode function within SquashfsHandler.cpp, which fails to properly validate error return values from the LZ4_decompress_safe function. When decompression fails, the function receives a negative error value but only checks for zero, allowing the negative int to be unsafely converted to an unsigned SizeT value. This corrupted size is later truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-controlled inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can cause memcpy to read beyond the _cachedBlock heap allocation, enabling information disclosure or process crash. The vulnerability affects versions 1.0.88.0 through 6.0.1698.0 (stable) and up to 6.5.1742.0 (preview), and is fixed in those releases.
Affected products
- M2Team NanaZip 1.0.88.0 to 6.0.1698.0
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0