EUVD-2026-42955Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted archive to target
-
DeliveryUser opens archive in NanaZip
-
ExploitUser triggers Test or Extract All
-
ExecutionHandler dereferences NULL Indices pointer
-
ImpactNanaZip process crashes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target have NanaZip (prior to 6.5.1749.0) installed on Windows, that the attacker deliver a crafted archive in one of exactly seven vulnerable formats (WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, or DotNetSingleFile), and that the user explicitly invoke the 'Test archive' or 'Extract all' operation (UI:P - passive user interaction per CVSS 4.0). Exploitation is limited to local context (AV:L); the attacker cannot trigger the crash remotely without the user's participation. The crash affects only the NanaZip process and does not escalate privileges or expose data. Exploitation is further constrained to the subset of users who encounter these niche archive formats in practice, which are uncommon in typical enterprise workflows. |
| Impact | The CVSS 4.0 score of 2.4 (Low) accurately reflects the limited real-world impact. The attack vector is local (AV:L), requires low privileges (PR:L), and demands passive user interaction (UI:P - the user must perform a Test or Extract operation on a crafted archive). Availability impact is limited to the NanaZip process itself (VA:L), with no confidentiality or integrity impact and no subsequent-system impact. No EPSS data was provided, and neither KEV listing nor public POC code has been identified, reinforcing that this is a low-priority issue. The vulnerability is not remotely exploitable - an attacker must first deliver a specially crafted archive to the target and induce the user to test or extract it. The net risk is an application crash, recoverable by restarting NanaZip, with no privilege escalation or data exposure. |
| Exploit ScenarioDerived | An attacker crafts a malicious archive file in one of the seven vulnerable formats (e.g., a WebAssembly or ElectronAsar archive) and delivers it to a target via email, file share, or download. The user opens the file with NanaZip and invokes 'Test archive' or 'Extract all', triggering the NULL pointer dereference and crashing the NanaZip process. No public exploit code has been identified at time of analysis, and the impact is limited to the application crash with no further system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
NULL pointer dereference in NanaZip's custom archive handlers crashes the application when a user tests or extracts archives of seven specific formats. All NanaZip versions prior to 6.5.1749.0 are affected; the seven vulnerable handlers cover WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archive types. Impact is limited to a process crash (denial of service) with no confidentiality or integrity consequence; no public exploit or active exploitation has been identified at time of analysis.
RemediationAI
Vendor-released patch: 6.5.1749.0. Users should upgrade NanaZip to version 6.5.1749.0 or later, available at https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0; the fix commit is documented at https://github.com/M2Team/NanaZip/commit/5d74d90b737ac7096e5d944a5a3070c5c6a8f894. If immediate upgrade is not possible, the most targeted workaround is to avoid using the 'Test archive' or 'Extract all' operations on untrusted archives of the seven affected formats (WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, DotNetSingleFile); extracting individual items rather than using the 'extract all' path may avoid triggering the NULL dereference, though this has not been independently confirmed by the vendor as a safe workaround. The trade-off is reduced functionality when processing these niche archive types. Given the low severity (process crash only), risk acceptance until the next maintenance window is a reasonable posture for organizations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NanaZip (CPE: cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*) is a Windows-native 7-Zip derivative that implements additional archive-format support through in-house IInArchive handler classes inside the NanaZip.Codecs component. The IInArchive::Extract interface in the 7-Zip architecture uses a convention where the caller passes Indices=NULL and NumItems=0xFFFFFFFF to signal 'extract all items'. Seven of NanaZip's custom handlers fail to check for this NULL Indices case before dereferencing the pointer, which is the root cause classified as CWE-476 (NULL Pointer Dereference). The flaw is triggered via the standard 'Test archive' or 'Extract all' code paths - operations exposed in the UI and command-line interface - not through unusual or undocumented API usage.
Know when Nanazip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Local delivery of crafted archive (AV:L), user must trigger extract/test (UI:R, PR:L), impact is process crash only (A:L), no C or I impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs unconditionally dereference the caller-supplied Indices array inside Extract when the archive engine signals extract everything by passing Indices as NULL and NumItems as 0xFFFFFFFF. This causes a NULL pointer dereference in the standard Test archive or Extract all code path for WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archives, resulting in a process crash. This issue is fixed in version 6.5.1749.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
A one-byte heap out-of-bounds null write (CWE-787) in NanaZip's UFS/UFS2 filesystem image parser allows a crafted .ufs,
Opening a crafted ZealFS v1 filesystem image in NanaZip builds from 5.0.1252.0 up to (but not including) 6.0.1698.0 trig
Process crash via uncaught C++ exception in NanaZip's .NET single-file bundle handler affects all versions prior to 6.5.
Stack exhaustion in NanaZip's UFS/UFS2 filesystem image parser crashes the application when a user opens a specially cra
Memory exhaustion in NanaZip's littlefs filesystem image parser (versions 5.0.1252.0 through before 6.0.1698.0) allows a
Exploit-DB