NanaZip EUVD-2026-29790

Exploitation requires that the victim open a crafted UFS or UFS2 filesystem image file using an affected version of NanaZip (5.0.1252.0 through before 6.0.1698.0) on their local machine; the CVSS UI:R metric confirms this user-interaction dependency. The attacker does not need any privileges on the target system - they only need to deliver the malicious archive file. Exploitation is further constrained to Windows environments where NanaZip is installed, and the impact is strictly limited to crashing the NanaZip process (denial-of-service) with no code execution surface and no confidentiality or integrity loss. Non-default configuration is not required: the UFS parser is part of NanaZip's standard archive-format support. The key limiting factors are the mandatory local file-open action by the victim and the crash-only outcome, which significantly reduces attacker motivation relative to code-execution vulnerabilities.

All available signals converge on low real-world risk. The CVSS 3.1 base score is 3.3 (Low), driven by a local attack vector (AV:L), no privileges required from the attacker, mandatory user interaction (UI:R), and an availability-only impact rated Low (A:L). EPSS confirms this: exploitation probability is 0.01%, placing this CVE at the 2nd percentile among all scored vulnerabilities. SSVC assessment by CISA reports exploitation status as 'none', automatable as 'no', and technical impact as 'partial', consistent with a crash-only outcome. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no POC code has been publicly released. The primary threat is an attacker who can persuade a user to open a malicious UFS archive - a social engineering dependency that limits mass exploitation. There is no integrity or confidentiality loss, and the impact is bounded to the NanaZip process crash rather than the host OS. The discrepancy between the CVE description's starting version (5.0.1252.0) and the EUVD's listing (5.0.1250.0) is minor and does not change the risk profile; the vendor advisory is authoritative.

An attacker crafts a UFS2 disk image containing either an extremely deep nested directory tree or a circular inode reference and delivers it to a target user via email, file share, or download link. When the user opens the image in an unpatched version of NanaZip, GetAllPaths recurses without bound into the directory structure, exhausting the thread's stack and crashing the NanaZip process. No public exploit code exists for this vulnerability at time of analysis.