EUVD-2026-29793Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Local attack vector because file must be opened on-system by the victim; PR:N since attacker needs no system privileges; UI:R mandatory; no confidentiality impact from a null-byte heap write.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0.
AnalysisAI
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) enables a limited heap corruption primitive when a user opens a crafted disk image. The attacker controls the byte offset of the single null-byte write within a ~254-byte window past the heap allocation boundary, yielding partial integrity and availability impact with no confidentiality exposure. No public exploit has been confirmed at time of analysis, EPSS places exploitation probability at the 2nd percentile, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
NanaZip (CPE: cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*) is an open-source Windows file archive utility derived from 7-Zip, developed by M2Team. The flaw resides in the UFS/UFS2 (Unix File System) image parser, which processes Unix-style disk images. CWE-787 (Out-of-Bounds Write) identifies the root cause: the parser fails to properly validate a computed write offset when ingesting a crafted filesystem image, allowing one null byte to land up to ~254 bytes beyond the end of a heap-allocated buffer. While a single null-byte write is more constrained than an arbitrary-value overwrite, controlled offset selection is a known heap manipulation primitive - an attacker can target specific metadata fields or size values in adjacent heap chunks, with exploitation reliability dependent on heap layout at runtime. The vulnerability was reported through GitHub's security advisory program (GHSA-44wh-7gc3-w936).
RemediationAI
The primary fix is upgrading NanaZip to version 6.0.1698.0 or later, where the vendor has resolved the out-of-bounds write in the UFS/UFS2 parser per the GitHub security advisory at https://github.com/M2Team/NanaZip/security/advisories/GHSA-44wh-7gc3-w936. For environments where immediate upgrade is not feasible, the most actionable compensating control is blocking delivery of UFS/UFS2 filesystem image files (.img, .ufs, and similar extensions) through email gateways, web proxies, and endpoint file-type controls - since exploitation requires a user to open a crafted image, preventing delivery eliminates the attack vector without disabling the application. User awareness guidance to avoid opening disk images from untrusted sources provides an additional low-cost layer. No functional side effects are expected from upgrading to 6.0.1698.0.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially cra
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today