EUVD-2026-29790Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Local file open required (AV:L, UI:R); attacker needs no privileges; impact is process crash only (A:L), with no confidentiality or integrity effect.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
AnalysisAI
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially crafted archive. Versions 5.0.1252.0 through 6.0.1698.0 (exclusive) are affected, with the flaw residing in the GetAllPaths function, which recurses into subdirectories without any depth ceiling or cycle-detection for inode loops. The impact is limited to a denial-of-service crash of the NanaZip process; no code execution or data exposure is possible. No public exploit and no active exploitation have been identified at time of analysis, and the EPSS score of 0.01% (2nd percentile) corroborates the low likelihood of real-world weaponization.
Technical ContextAI
NanaZip (CPE: cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*) is an open-source Windows file archiver derived from 7-Zip. The vulnerable component is its UFS/UFS2 (Unix File System) image parser. CWE-674 (Uncontrolled Recursion) describes the root cause: the GetAllPaths function calls itself for each subdirectory encountered in the filesystem image without enforcing a maximum recursion depth and without maintaining a set of visited inode numbers. UFS/UFS2 inodes can form cycles (hard links to directories in older UFS or crafted images), so an attacker can create either an arbitrarily deep directory tree or a circular inode graph. Either construct causes unbounded stack frame growth until the thread's stack space is exhausted, producing an access violation that terminates the NanaZip process. The vulnerability is entirely within the parsing logic and does not reach memory-allocation or execution primitives.
RemediationAI
Upgrade to NanaZip 6.0.1698.0, which is confirmed by the vendor to contain the fix for this vulnerability; the patch is available via the GitHub advisory at https://github.com/M2Team/NanaZip/security/advisories/GHSA-jpf5-j78p-cp3x. For environments where immediate upgrade is not feasible, the principal compensating control is to prohibit or discourage users from opening UFS/UFS2 filesystem image files (.ufs, .img) received from untrusted or external sources; this directly eliminates the user-interaction prerequisite without affecting NanaZip's handling of other archive formats. No network-layer mitigations are applicable given the local file-open attack vector. The trade-off of the file-type restriction workaround is loss of legitimate UFS archive functionality until patching is complete.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today