EUVD-2026-29791Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Local file-open vector with mandatory user interaction; no privileges needed on target system; partial confidentiality from stack read and partial availability from potential crash only.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the end of a stack-allocated ZEALFS_V1_HEADER structure. This vulnerability is fixed in 6.0.1698.0.
AnalysisAI
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before 6.0.1698.0, allowing an attacker who tricks a user into opening a crafted archive to leak stack memory and potentially crash the application. The root cause is an attacker-controlled BitmapSize header field that drives an unbounded loop reading past the end of a stack-allocated ZEALFS_V1_HEADER structure, yielding limited confidentiality and availability impact. No active exploitation has been confirmed - EPSS is 0.01% (2nd percentile), SSVC rates exploitation as none, and no KEV listing or public exploit code exists at time of analysis.
Technical ContextAI
NanaZip (CPE: cpe:2.3:a:m2team:nanazip) is an open source Windows file archiver derived from 7-Zip. Its ZealFS filesystem image parser allocates a fixed-size ZEALFS_V1_HEADER structure on the stack to parse version 1 ZealFS images. The BitmapSize field within that header is consumed directly from attacker-supplied file data without bounds validation, causing the parser to iterate beyond the allocated buffer boundary - a classic CWE-125 (Out-of-bounds Read) pattern. Because the read target is stack memory, the resulting exposure is limited to whatever stack data happens to follow the header structure (adjacent locals, return addresses, canary values), which maps to the CVSS C:L impact rating. An abnormal termination of the parsing loop or an access violation can also produce a crash, explaining the A:L rating. No heap allocation or write primitive is implied by the description, consistent with the I:N rating and the absence of a code-execution scenario.
RemediationAI
Upgrade NanaZip to version 6.0.1698.0 or later, which is the vendor-released patch confirmed by the GitHub security advisory at https://github.com/M2Team/NanaZip/security/advisories/GHSA-4c79-hfr4-mqv9. If an immediate upgrade is not feasible, users should refrain from opening ZealFS v1 filesystem image files from untrusted sources in NanaZip - this eliminates the attack surface entirely since exploitation requires active user interaction with a crafted file. There is no documented application-level configuration setting to disable ZealFS parsing. The only confirmed remediation path is applying the 6.0.1698.0 patch; the file-avoidance workaround is a temporary compensating control with the trade-off that legitimate ZealFS images from trusted sources must also be treated with caution until patching is complete.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially cra
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today