NanaZip CVE-2026-42442

Exploitation requires that the victim user actively opens a crafted UFS/UFS2 filesystem image file using NanaZip versions 5.0.1252.0 through 6.0.1697.x (UI:R is confirmed by the CVSS vector). The UFS parser must be invoked, meaning the file must be presented as or identified as a UFS image. The crafted image must contain a root inode (inode 2) typed IFLNK with a di_size small enough to produce a zero-length directory buffer. No authentication or elevated privileges are required (PR:N), but exploitation is limited to the local system context where the file is opened. Exploitation is further constrained by: the relative rarity of UFS image handling in typical Windows workflows, the requirement for user interaction to open the file, and the impact being limited to a crash of the NanaZip process only (S:U, A:L).

All available signals converge on low real-world risk. The CVSS 3.1 base score of 3.3 reflects a local attack vector (AV:L), user interaction required (UI:R), no privilege escalation, and only low availability impact (A:L) - specifically, a crash of the NanaZip process rather than system-wide disruption. The EPSS score of 0.01% (2nd percentile) indicates the vulnerability is extremely unlikely to be exploited in the near term. CISA SSVC assessment confirms exploitation status as 'none', the attack is not automatable, and technical impact is only partial. No entry in the CISA KEV catalog and no public exploit code has been identified. The attack is constrained to a user who actively opens a malicious UFS image file in NanaZip - a scenario requiring social engineering or malicious file delivery. There are no conflicting signals; all sources consistently describe a low-priority, user-triggered denial-of-service with no confidentiality or integrity impact.

An attacker crafts a UFS disk image where the root inode (inode 2) is deliberately typed as a symlink (IFLNK) with a small di_size, then delivers this file to a target user via email attachment, file share, or download link. When the user double-clicks or opens the image in NanaZip, the parser's missing type check causes it to dereference a zero-length buffer, crashing the application immediately. No public exploit code exists for this scenario at time of analysis.