EUVD-2026-29786Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Local file-open required with mandatory user interaction; crash confined to NanaZip process with no data exposure or privilege change, justifying A:L only.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
AnalysisAI
Stack exhaustion in NanaZip's Electron Archive (ASAR) parser crashes the application when a user opens a specially crafted .asar file containing deeply nested JSON in the archive header. Versions 5.0.1252.0 through 6.0.1695.x are affected on Windows; exploitation requires local user interaction with no privilege escalation or code execution path. No public exploit exists and EPSS sits at 0.01% (2nd percentile), consistent with SSVC's 'Exploitation: none' signal - this is a low-priority denial-of-service fixed in the vendor-released 6.0.1698.0.
Technical ContextAI
NanaZip (CPE: cpe:2.3:a:m2team:nanazip) is an open-source Windows file archiver derived from 7-Zip that added support for Electron Application Archives (.asar). The .asar format stores a JSON object in its header describing the archive's file tree; NanaZip uses the nlohmann::json library to parse this header and a custom GetAllPaths function to enumerate paths from the parsed structure. CWE-674 (Uncontrolled Recursion) identifies the root cause: neither nlohmann::json::parse nor GetAllPaths enforces a recursion depth limit, so a JSON object nested to extreme depth drives recursive calls until the thread's call stack is exhausted, triggering a stack overflow crash. This is a well-understood parser vulnerability class - the fix requires adding an explicit depth counter or leveraging the library's built-in depth-limit parameter.
RemediationAI
Upgrade NanaZip to version 6.0.1698.0 or later, which is the vendor-released patch addressing uncontrolled recursion in both nlohmann::json::parse and GetAllPaths; details are available in the GitHub security advisory at https://github.com/M2Team/NanaZip/security/advisories/GHSA-4gxf-p4q6-gfrf. Until patching is feasible, the most effective compensating control is to instruct users not to open .asar files received from untrusted sources, as exploitation requires a user to actively open a crafted archive - blocking this user action eliminates the attack surface entirely without side effects. Organizations can also configure endpoint controls (e.g., file-type association restrictions or DLP policies) to prevent NanaZip from being invoked on .asar files from external sources. Given the CVSS 3.3 score, absence of active exploitation, and niche product footprint, this does not warrant emergency patching; standard patch-cycle inclusion is appropriate.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today