What is the CVSS score of CVE-2026-42442?

CVE-2026-42442 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42442?

Yes, a patch is available for CVE-2026-42442. Update the affected software to the latest version immediately.

NanaZip CVE-2026-42442

EUVD-2026-29787 LOW

NULL Pointer Dereference (CWE-476)

2026-05-12 GitHub_M

Denial Of Service Null Pointer Dereference Nanazip M2Team

3.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

3.3 LOW

Local vector and required user interaction confirmed by file-open trigger; no privileges needed; impact is solely an application crash, so A:L with C:N and I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:42 vuln.today

Patch available

May 12, 2026 - 21:03 EUVD

CVE Published

May 12, 2026 - 19:21 nvd

LOW 3.3

DescriptionGitHub Advisory

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats the root inode as a directory without checking its type, and when the symlink has an embedded target (small di_size), the directory data buffer is zero-length, causing a null-pointer dereference on the first read. This vulnerability is fixed in 6.0.1698.0.

AnalysisAI

NanaZip's UFS/UFS2 filesystem image parser crashes with a null-pointer dereference when a user opens a specially crafted archive. Affected versions 5.0.1252.0 through 6.0.1697.x fail to validate the type of the root inode before treating it as a directory: when inode 2 is typed IFLNK with a small di_size, the directory data buffer is allocated as zero-length and immediately dereferenced, crashing the application. No active exploitation has been identified (EPSS 0.01%, SSVC exploitation: none), and impact is limited to denial of service against the local NanaZip process.

Technical ContextAI

NanaZip (CPE: cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*) is an open-source Windows file archiver derived from 7-Zip. The affected component is its UFS/UFS2 filesystem image parser - a reader for Unix File System disk images. CWE-476 (NULL Pointer Dereference) describes the root cause: the parser unconditionally treats the root inode (inode 2) as a directory (IFDIR) without first checking its st_mode type field. When a crafted image supplies a symlink inode (IFLNK) at that position with a small di_size value, the parser allocates a zero-length directory data buffer and then dereferences it on the first read, triggering a null-pointer dereference. This is a classic missing type-validation flaw in a format parser.

RemediationAI

The primary fix is to upgrade NanaZip to version 6.0.1698.0 or later, which is confirmed as the patched release by both the CVE description and the vendor GitHub Security Advisory at https://github.com/M2Team/NanaZip/security/advisories/GHSA-8r4x-fx3w-ph77. If an immediate upgrade is not feasible, a practical compensating control is to avoid opening untrusted UFS/UFS2 filesystem image files in NanaZip; UFS images are an uncommon format in most Windows environments, so restricting or disallowing this file type via file association policy carries minimal operational impact. No other workarounds are documented by the vendor.