CVE-2026-42446

NanaZip from version 1.0.88.0 until stable 6.0.1698.0 and preview 6.5.1742.0 has a vulnerability in the Lz4Decode function that rejects only a zero return from LZ4_decompress_safe, while malformed input produces a negative error value. The negative int is converted to unsigned SizeT, leading to out-of-bounds read and potential data leak or crash.

A vulnerability in NanaZip (a 7-Zip fork for Windows) prior to version 6.5.1749.0 causes a process crash when testing or extracting WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archives. The issue stems from unconditionally dereferencing the caller-supplied Indices pointer, which can be NULL when the archive engine signals extraction of all items.

NanaZip prior to version 6.5.1749.0 has a vulnerability in its WebAssembly archive handler where an attacker can control buffer allocation sizes. By crafting a file with manipulated NameSize and Information.Size fields, multi-gigabyte memory allocations can be forced, leading to memory exhaustion or process termination.

A vulnerability in NanaZip (a 7-Zip fork for Windows) prior to version 6.5.1749.0 allows an attacker to cause memory exhaustion via a crafted UFS/FFS image. Missing validation of the fragment size (fs_fsize) lets a tiny image force multi-gigabyte allocations during open or extraction.

A vulnerability in NanaZip (a 7-Zip fork for Windows) prior to version 6.5.1749.0 allows process crashes via a crafted .NET single-file bundle. The issue stems from missing validation of the extraction buffer size against the actual file size, potentially leading to std::bad_alloc or std::length_error exceptions.

In NanaZip from 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser. The vulnerability is triggered when opening a crafted UFS filesystem image, with the attacker controlling the write offset within a ~254-byte window past the heap allocation boundary.

An uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip from 5.0.1252.0 to before 6.0.1698.0. The GetAllPaths function recurses into subdirectories without a depth limit, causing stack exhaustion and a crash when opening a crafted image.

A denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip from 5.0.1252.0 to before 6.0.1698.0. The Open method reads BlockCount from the attacker-controlled superblock without validation, causing billions of heap allocations and memory exhaustion.

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero; the parser uses this attacker-controlled value as a divisor without validation, causing an immediate hardware trap and process crash. This vulnerability is fixed in 6.0.1698.0.

A null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip from 5.0.1252.0 to before 6.0.1698.0. When the root inode is a symlink instead of a directory, the parser causes a null-pointer dereference.