NanaZip CVE-2026-42443

Exploitation requires that the victim user actively open a crafted UFS or UFS2 filesystem image file using NanaZip versions 5.0.1252.0 through 5.x on Windows. The vulnerable code path is the UFS/UFS2 superblock parser, which is only invoked when a UFS image type is processed - standard archive formats (ZIP, 7z, RAR) are unaffected. The attack vector is local (AV:L) per the CVSS vector, meaning the crafted file must be accessible on the local filesystem at the time of opening. User interaction is mandatory (UI:R): the crash cannot be triggered remotely or automatically without the user choosing to open the file. Exploitation is further limited by NanaZip being a niche Windows archiver, reducing the population of reachable targets. There is no authentication bypass component; the crash affects only the NanaZip process and does not escalate privileges or affect system availability.

All available signals converge on very low real-world priority. The CVSS 3.1 base score is 3.3 (Low), with a local attack vector (AV:L), no privilege requirement (PR:N), and mandatory user interaction (UI:R) - an attacker cannot reach this code path without a victim deliberately opening a crafted file. The sole impact is limited availability (A:L), meaning only the NanaZip process crashes with no data loss or system-wide effect. EPSS at 0.01% places this in the 2nd percentile of exploitation likelihood across all CVEs, consistent with SSVC classification of Exploitation: none and Automatable: no. There is no CISA KEV listing and no public proof-of-concept. Technical Impact is rated partial by SSVC, aligned with the limited crash-only outcome. No signal conflicts are present; all sources agree this is a low-severity, locally-triggered denial-of-service with no current exploitation activity.

An attacker crafts a UFS disk image with the fs_ipg field in the superblock set to zero, then delivers it to a target user via email attachment, file share, or download. When the user opens the file in an affected version of NanaZip, the parser reads the zero value and immediately performs a division, triggering a hardware divide fault that terminates the NanaZip process. No public exploit code is known to exist for this vulnerability.