EUVD-2026-42955Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local delivery of crafted archive (AV:L), user must trigger extract/test (UI:R, PR:L), impact is process crash only (A:L), no C or I impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs unconditionally dereference the caller-supplied Indices array inside Extract when the archive engine signals extract everything by passing Indices as NULL and NumItems as 0xFFFFFFFF. This causes a NULL pointer dereference in the standard Test archive or Extract all code path for WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archives, resulting in a process crash. This issue is fixed in version 6.5.1749.0.
AnalysisAI
NULL pointer dereference in NanaZip's custom archive handlers crashes the application when a user tests or extracts archives of seven specific formats. All NanaZip versions prior to 6.5.1749.0 are affected; the seven vulnerable handlers cover WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archive types. Impact is limited to a process crash (denial of service) with no confidentiality or integrity consequence; no public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
NanaZip (CPE: cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*) is a Windows-native 7-Zip derivative that implements additional archive-format support through in-house IInArchive handler classes inside the NanaZip.Codecs component. The IInArchive::Extract interface in the 7-Zip architecture uses a convention where the caller passes Indices=NULL and NumItems=0xFFFFFFFF to signal 'extract all items'. Seven of NanaZip's custom handlers fail to check for this NULL Indices case before dereferencing the pointer, which is the root cause classified as CWE-476 (NULL Pointer Dereference). The flaw is triggered via the standard 'Test archive' or 'Extract all' code paths - operations exposed in the UI and command-line interface - not through unusual or undocumented API usage.
RemediationAI
Vendor-released patch: 6.5.1749.0. Users should upgrade NanaZip to version 6.5.1749.0 or later, available at https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0; the fix commit is documented at https://github.com/M2Team/NanaZip/commit/5d74d90b737ac7096e5d944a5a3070c5c6a8f894. If immediate upgrade is not possible, the most targeted workaround is to avoid using the 'Test archive' or 'Extract all' operations on untrusted archives of the seven affected formats (WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, DotNetSingleFile); extracting individual items rather than using the 'extract all' path may avoid triggering the NULL dereference, though this has not been independently confirmed by the vendor as a safe workaround. The trade-off is reduced functionality when processing these niche archive types. Given the low severity (process crash only), risk acceptance until the next maintenance window is a reasonable posture for organizations.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today