NanaZip CVE-2026-54616

Exploitation requires the victim to open a specially crafted SquashFS-format archive file using an affected NanaZip version on Windows. The bug is triggered specifically in the SquashFS handler's LZ4 decompression path - other archive formats (ZIP, 7z, RAR, TAR, etc.) processed by NanaZip are not affected by this flaw. No special NanaZip configuration, enabled features, or elevated system privileges are required; the CVSS PR:N rating confirms the attacker needs no prior access to the target system. The primary limiting factor is UI:R: the victim must actively open the malicious archive, typically via social engineering, a malicious download, or a compromised file share. Exploitation is bounded to the NanaZip process context (S:U), so OS-level or cross-process impact is not expected from this bug alone.

The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) is well-calibrated: the network vector reflects that malicious archives are typically delivered via download or email, user interaction is required to open the file, and the High confidentiality impact reflects genuine heap memory disclosure - potentially exposing sensitive runtime data such as file paths, credentials cached in process memory, or other recently processed archive content. The Low availability impact (A:L) represents a process crash without system-wide disruption. EPSS data was not included in the provided intelligence, so quantitative exploitation probability cannot be stated. The absence from CISA KEV and lack of any referenced POC or exploit code together indicate this is not currently under active mass exploitation. The UI:R requirement meaningfully limits opportunistic attack surface compared to server-side vulnerabilities, and only SquashFS archives with LZ4 compression trigger the flaw - a narrower target than general-purpose archive opening. Overall, this is a genuine and patchable information-disclosure risk for NanaZip users who process untrusted archive content, with urgency proportional to the sensitivity of data colocated in the NanaZip process heap.

An attacker crafts a SquashFS archive with LZ4-compressed fragment data engineered to cause LZ4_decompress_safe to return a negative error code, paired with a malicious inode Offset value in the fragment descriptor. When a victim opens the archive in an unpatched NanaZip, the decompressor misinterprets the negative return as a large unsigned block size, the subsequent memcpy overshoots the heap buffer boundary, and the extracted file output contains adjacent heap contents - potentially including filenames, recently processed data, or other sensitive in-process information. No public exploit code is known at time of analysis, but the primitive is mechanically straightforward for an attacker with knowledge of the SquashFS format and LZ4 error semantics.