What is the CVSS score of CVE-2026-42443?

CVE-2026-42443 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-42443?

Yes, a patch is available for CVE-2026-42443. Update the affected software to the latest version immediately.

NanaZip CVE-2026-42443

EUVD-2026-29788 LOW

Divide By Zero (CWE-369)

2026-05-12 GitHub_M

Denial Of Service Nanazip M2Team

3.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

3.3 LOW

Local file open required (AV:L, UI:R); no credentials needed; crash-only impact with no confidentiality or integrity effect (C:N, I:N, A:L).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:42 vuln.today

Patch available

May 12, 2026 - 21:03 EUVD

CVE Published

May 12, 2026 - 19:21 nvd

LOW 3.3

DescriptionGitHub Advisory

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero. The parser uses this attacker-controlled value as a divisor without validation, causing an immediate hardware trap and process crash. This vulnerability is fixed in 6.0.1698.0.

AnalysisAI

Integer divide-by-zero in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially crafted archive. Affected versions 5.0.1252.0 through 5.x fail to validate the superblock field fs_ipg before using it as a divisor; setting it to zero in a crafted image triggers an immediate hardware trap and process termination. No public exploit has been identified and EPSS probability sits at 0.01% (2nd percentile), indicating negligible real-world exploitation risk at time of analysis.

Technical ContextAI

NanaZip (CPE: cpe:2.3:a:m2team:nanazip) is an open-source Windows file archive utility derived from 7-Zip. Its UFS/UFS2 parser reads the BSD Unix Filesystem superblock field fs_ipg - which encodes the number of inodes per cylinder group - and uses it as a divisor in inode offset calculations without a zero-check guard. CWE-369 (Divide By Zero) describes exactly this root cause: an attacker-controlled integer zero propagates into an arithmetic operation, causing a hardware-level divide fault. UFS/UFS2 is the native filesystem of FreeBSD and older macOS systems; parsing such images in an archiver on Windows is a relatively uncommon but supported feature, and the parser trusts the superblock without sanitizing attacker-supplied metadata fields.

RemediationAI

Upgrade NanaZip to version 6.0.1698.0 or later, which introduces validation of the fs_ipg superblock field before its use as a divisor. The vendor advisory is available at https://github.com/M2Team/NanaZip/security/advisories/GHSA-3x2h-gqqw-g3gm and the VulDB record at https://vuldb.com/vuln/363328. For environments where upgrading immediately is not possible, the practical compensating control is to instruct users not to open UFS or UFS2 filesystem image files (.ufs, raw disk images) from untrusted sources, as the crash is only triggered by the UFS parser code path. Because impact is limited to application crash with no privilege escalation or data exposure, the risk of delayed patching is low for most deployments.