NanaZip EUVD-2026-29791

Exploitation requires a victim to open or list an attacker-crafted ZealFS v1 filesystem image in a vulnerable NanaZip build (>=5.0.1252.0 and <6.0.1698.0 Stable). The ZealFS handler is registered for the 'zealfs' extension with SevenZipHandlerFlagFindSignature and a 1-byte 'Z' (0x5A) signature, so format recognition needs only Magic'Z' and Version1 at offset 0 - the attacker controls all remaining bytes, including the single-byte BitmapSize field, which must be set in the range 33-255 to drive the loop past the 32-byte PagesBitmap array. Limiting factors: the vector is local (AV:L) and requires user interaction (UI:R) - there is no remote or unauthenticated-service exposure; reliable confidentiality impact additionally requires repeated reads of the exposed free-space value to reconstruct stack bytes, whereas a single open mainly yields a crash/DoS. No affected default network service is involved.

This is a moderate, defensible-severity issue that should NOT be treated as an emergency, and the multi-source signals agree on that. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 7.1) correctly captures a local, user-interaction-dependent flaw: the victim must open an attacker-crafted ZealFS v1 image, so there is no remote or automatable mass-exploitation path. This aligns with the SSVC framework (Exploitation: none, Automatable: no, Technical Impact: partial) and with the extremely low EPSS score (0.01%, 2nd percentile), which indicates no observed or predicted real-world exploitation activity. The vuln.today 'this_week' priority is driven by the C:H/A:H impact and the availability of a fix, not by active exploitation. The flaw is NOT in CISA KEV and there is no confirmed active exploitation. The one nuance worth flagging: the GHSL advisory documents a concrete reproduction path and ASan crash, and realistic confidentiality impact (C:H) depends on an attacker being able to repeatedly query the SevenZipArchiveFreeSpace property with varying BitmapSize values to reconstruct stack bytes - a single opened file primarily yields a crash/DoS, while meaningful information disclosure (potential canary/return-address leak enabling ASLR bypass) requires multiple controlled observations. No signals conflict: all point to a genuine but low-urgency, interaction-gated vulnerability.

An attacker distributes a small crafted file with the .zealfs extension (or a file beginning with the byte 'Z' that NanaZip's signature scanner recognizes) via email, download, or a shared drive, and a victim opens or lists it in NanaZip. The parser's unbounded loop over the attacker-controlled BitmapSize field reads up to 195 bytes past the stack-allocated ZEALFS_V1_HEADER, crashing the process (DoS) or, through repeated queries of the exposed free-space value, leaking adjacent stack contents such as saved return addresses or stack-cookie material. A public PoC reference exists (the advisory shows a NanaZip.Universal.Console.exe l poc.zealfs reproduction and an AddressSanitizer crash trace); it is not verified as working exploit code, and the CVSS local vector with required user interaction limits realistic exploitation.