NanaZip CVE-2026-42444

Exploitation requires the victim to open a crafted littlefs filesystem image using a vulnerable version of NanaZip (5.0.1252.0 to before 6.0.1698.0) on a Windows system - confirmed by CVSS AV:L (local file access) and UI:R (required user interaction). The attacker must deliver the malicious file via an out-of-band channel (email, download, removable media) and convince the user to open it with NanaZip specifically. No network-exposed service, no authentication bypass, no special system configuration, and no elevated privileges are required. Exploitation is bounded to availability impact only - no code execution, privilege escalation, or data access is possible. The attack is further limited by requiring active user participation and is not automatable per SSVC, reducing the risk of worm-style or drive-by propagation.

The CVSS 3.3 (Low) score accurately reflects the constrained threat model: AV:L requires the attacker to deliver a file to the victim's local machine, UI:R requires the victim to open it with NanaZip, and impact is limited to availability (A:L) with no confidentiality or integrity component. EPSS at 0.01% (2nd percentile) is fully consistent with this low-severity assessment and signals negligible observed exploitation in the wild. SSVC classifies the vulnerability as having a proof-of-concept, non-automatable exploitation path, and partial technical impact - all aligned with a local, user-triggered, DoS-only flaw. No CISA KEV listing exists. One signal worth flagging: the sheer volume of heap allocations (4 billion) could in practice exhaust host-level memory rather than just crashing NanaZip, which may make the real-world availability impact closer to High than the scored A:L suggests on low-RAM systems - however this does not change the attack vector or privilege requirements. Overall, this is a low operational priority: it affects an end-user desktop application, cannot be exploited remotely or without victim interaction, and cannot achieve code execution or data access.

An attacker crafts a 44-byte littlefs filesystem image with the BlockCount superblock field set to 0xFFFFFFFF and delivers it to a target user via email attachment, instant message, or a malicious download page, disguised as a legitimate compressed archive. When the victim double-clicks the file and NanaZip opens it, the parser begins allocating a heap entry for each of approximately 4.29 billion purported blocks, rapidly consuming all available system RAM and causing NanaZip to hang or crash, potentially destabilizing the host on low-memory systems. A proof-of-concept is noted by SSVC, though no public URL for the PoC is included in the provided references; social engineering is the primary barrier to exploitation.