NanaZip CVE-2026-44215

Exploitation requires the victim to open or list a crafted UFS/UFS2 filesystem image in NanaZip; the UFS handler is registered for the ufs, ufs2, and img file extensions, and the MSIX manifest's wildcard file association enables format autodetection, so the crafted bytes alone can route to the vulnerable parser. The write occurs during IInArchive::Open(), before any further user interaction. The trigger condition is specific: the inode's file size must be a multiple of the block size so the directory buffer (ActualSize = BlockOffsetsCount * BlockSize) has no trailing slack, and a directory entry with minimal d_reclen (9) and maximal d_namlen (255) is positioned near the buffer end to drive the null write up to 254 bytes past the allocation. Limiting factors: user interaction is required (the victim must open the file - CVSS UI:R and SSVC Automatable=no), only versions from 5.0.1250.0 to before 6.0.1698.0 are affected, and enabled Win32 mitigations (CFG, CET shadow stack, no-remote-images, child-process and dynamic-code restrictions) make escalation beyond DoS substantially harder, though they do not prevent the heap corruption itself.

This is a genuinely moderate issue, not an inflated high-CVSS score, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, 7.1) correctly reflects a flaw reachable via a crafted file that the victim must open (UI:R), with no confidentiality impact, limited integrity impact (a single attacker-positioned null byte), and high availability impact (reliable crash). The real-world exploitation signals all point to low urgency: EPSS is 0.01% (2nd percentile), there is no CISA KEV listing, and SSVC records Exploitation=poc, Automatable=no, Technical Impact=partial. The vuln.today priority is 'this_week', consistent with a patchable, user-interaction-gated memory-corruption bug rather than an emergency. The primary confirmed impact is denial of service (heap-metadata corruption causing a crash); the advisory explicitly describes a potential heap-corruption primitive but states that demonstrating code execution is beyond the report's scope, and notes that NanaZip's enabled mitigations (CFG, CET shadow stack, no-remote-images, child-process and dynamic-code restrictions) raise the bar for RCE. SSVC Automatable=no aligns with the UI:R requirement - exploitation is not wormable or drive-by at scale, favoring targeted use. No signals conflict here; the combination of low EPSS, no KEV, poc-only exploitation, and a user-open requirement indicates a real but non-urgent, update-this-cycle priority.

An attacker crafts a malicious UFS1/UFS2 filesystem image (e.g. a .img file) and delivers it to a victim via email, download, or a shared drive, relying on NanaZip's wildcard file association and format autodetection. When the victim opens or lists the archive, the UFS directory parser writes a single null byte up to 254 bytes past a heap allocation, corrupting adjacent heap metadata and crashing the process. The advisory includes a documented PoC generator (a 128 KiB UFS1 image) with exact triggering steps and AddressSanitizer confirmation; this is a public PoC reference and is not verified as a working exploit beyond reliable DoS.