CVE-2026-42443

NanaZip (open source archiver) contains a local-denial bug in its UFS/UFS2 filesystem image parser. From versions 5.0.1252.0 up to before 6.0.1698.0, an integer divide-by-zero occurs when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is zero. The parser...

CVE-2026-42355

CVE-2026-42355 affects NanaZip, an open‑source file archive. The issue is an uncontrolled recursion in the Electron Archive (ASAR) parser when opening a crafted .asar with deeply nested JSON in the header. The recursion occurs in both nlohmann::json::parse and the handler’s GetAllPaths, consuming...

CVE-2026-42442

Summary: CVE-2026-42442 affects NanaZip, an open source file archive, in versions 5.0.1252.0 through before 6.0.1698.0. A null‑pointer dereference occurs in the UFS/UFS2 filesystem image parser when opening a crafted UFS image whose root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR ...

CVE-2026-44215

Summary: NanaZip versions 5.0.1252.0 through before 6.0.1698.0 contain a bug in the UFS/UFS2 filesystem image parser that allows a one-byte heap out-of-bounds null write when opening a crafted UFS image. Vulnerability details: attacker-controlled byte offset within a ~254-byte window past the hea...

CVE-2026-27710

CVE-2026-27710 affects NanaZip prior to fixed versions 6.0.1638.0 and 6.5.1638.0, where the ".NET Single File Application" parser is vulnerable to a denial-of-service due to an integer underflow in header-size calculation, which can trigger an unbounded memory allocation when opening a crafted bu...

CVE-2026-42446

CVE-2026-42446 affects NanaZip through versions 5.0.1252.0–before 6.0.1698.0. A stack-based out-of-bounds read occurs in the ZealFS filesystem image parser when opening a crafted ZealFS v1 image. The vulnerability is triggered by an attacker-controlled BitmapSize field in the file header, driving...

CVE-2026-27014

CVE-2026-27014 affects NanaZip’s ROMFS archive parser. From the provided records, versions before 6.0.1630.0 (specifically starting 5.0.1252.0 up to

CVE-2026-27711

CVE-2026-27711 affects NanaZip (open source file archive) through a memory corruption flaw in NanaZip’s UFS parser present in versions prior to 6.0.1638.0 and 6.5.1638.0. A crafted .ufs/.ufs2/.img file can trigger out-of-bounds memory access during archive open/list operations, reachable via norm...

CVE-2026-42444

NanaZip: Unbounded resource consumption DoS in the littlefs image parser. From 5.0.1252.0 to before 6.0.1698.0, the parser reads BlockCount from a crafted superblock without validation, then allocates per-iteration path entries. A 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 bill...

CVE-2026-42445

NanaZip 5.0.1252.0–before 6.0.1698.0 contains an uncontrolled recursion vulnerability in the UFS/UFS2 filesystem image parser. The function GetAllPaths recurses into subdirectories without a depth limit or visited-inode tracking, allowing a crafted UFS image with a very deep directory tree or an ...

CVE-2026-27114

NanaZip has an infinite-loop vulnerability in its ROMFS archive parser caused by circular NextOffset chains in versions 5.0.1252.0 through before 6.0.1630.0. Version 6.0.1630.0 patches the issue. Affected component: ROMFS archive parsing within NanaZip. Impact (as stated): availability is HIGH, w...

CVE-2026-26282

NanaZip (open source file archiver) is affected by CVE-2026-26282: an out-of-bounds heap read in the .NET Single File bundle header parser due to a missing bounds check. Affected versions are 5.0.1252.0 through prior to 6.0.1630.0; upgrading to 6.0.1630.0 patches the issue. Exploitation would req...

CVE-2026-27709

NanaZip (open source) version range prior to 6.0.1638.0 and 6.5.1638.0 is affected by an out-of-bounds read in the .NET Single File Application parser during manifest parsing. A crafted bundle can cause a malformed RelativePathLength, leading to the parser constructing a std::string from memory b...