EUVD-2026-63481Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
AV:N for network-delivered archive files; UI:R because user must open the file; C:H for heap memory disclosure; A:L for process crash only; I:N as out-of-bounds read has no write primitive.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.
AnalysisAI
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a user opens a crafted archive, affecting all stable releases from 1.0.88.0 through 6.0.1697.x and all preview releases through 6.5.1741.x on Windows. The flaw stems from a sign-conversion bug that causes the decompressor to trust an attacker-inflated block size, allowing a controlled memcpy to read beyond the allocated heap buffer and place internal heap data into the extracted file output, or crash the process entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a specially crafted SquashFS-format archive file using an affected NanaZip version on Windows. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) is well-calibrated: the network vector reflects that malicious archives are typically delivered via download or email, user interaction is required to open the file, and the High confidentiality impact reflects genuine heap memory disclosure - potentially exposing sensitive runtime data such as file paths, credentials cached in process memory, or other recently processed archive content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade NanaZip to stable release 6.0.1698.0 (https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0) or preview release 6.5.1742.0 (https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0), both of which contain the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all systems running NanaZip versions 1.0.88.0 through 6.5.1741.x and restrict the application's use to trusted, internal archives only; disable NanaZip entirely on any system that processes externally sourced files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially cra
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today