NanaZip CVE-2026-42355

Exploitation requires the victim to be running NanaZip version 5.0.1252.0 or later but before 6.0.1698.0, and NanaZip's ASAR parser must be invoked by the user actively opening or previewing a crafted .asar archive file - CVSS UI:R explicitly confirms mandatory user interaction. There is no network-reachable attack surface: AV:L means the malicious file must already be present on the local filesystem or a locally mounted path before the user opens it, requiring a separate delivery mechanism such as phishing or removable media. Authentication is not required (PR:N) in the sense that no login to NanaZip is needed, but the attacker cannot trigger the flaw without first delivering the file to the victim's machine. The crash is scoped to the NanaZip process only (S:U), and no code execution or privilege escalation path has been identified. No non-default configuration is required - any NanaZip installation in the affected version range will attempt to parse .asar files by default. Exploitation is limited to desktop systems where NanaZip is installed; server deployments are not a relevant target.

The CVSS 3.3 base score precisely reflects the constrained impact envelope. AV:L rules out any network-reachable exploitation; UI:R mandates that a user actively opens the malicious file; S:U confines the crash to the NanaZip process; and C:N/I:N mean no data is exposed or altered - only availability is affected, and only at the application level (A:L). EPSS at 0.01% (2nd percentile) confirms near-zero exploitation interest from the broader threat community, and SSVC's 'Automatable: no' finding eliminates the risk of worm-style or mass-campaign exploitation. No CISA KEV listing and no reported POC code further reduce urgency. The honest risk posture: this is a nuisance-level crash affecting a niche Windows desktop application, with realistic impact limited to a user losing unsaved session state. It should be patched in the next normal release cycle, not treated as an emergency.

An attacker crafts a malicious .asar file whose JSON header contains an object nested to extreme depth - potentially thousands of levels - and delivers it to a target via phishing email, a shared drive, or a compromised download site. When the victim opens the file in an affected NanaZip version, the ASAR parser's unconstrained recursive calls exhaust the thread stack and abruptly crash the NanaZip process. No public exploit code exists at time of analysis, and the impact is confined to the application crash with no persistence, privilege gain, or data exposure.