NanaZip EUVD-2026-42957

Exploitation requires a user running NanaZip prior to version 6.5.1749.0 on Windows to open or attempt extraction of a specially crafted UFS or FFS disk image file. The CVSS 4.0 vector confirms PR:L (the attacker must be able to place the file where the victim will encounter it - no anonymous remote delivery) and UI:P (the victim must actively open the file, providing passive user interaction). The vulnerable code path is exclusively the UFS/FFS handler in NanaZip.Codecs.Archive.Ufs.cpp; no other archive formats are affected by this flaw. Exploitation impact is bounded to availability of the NanaZip process (VA:L) with no confidentiality or integrity compromise and no spillover to other system components (SC:N/SI:N/SA:N). The rarity of UFS/FFS images in typical Windows environments further limits realistic exposure beyond deliberate social-engineering delivery.

The CVSS 4.0 score of 2.4 (Low) is well-calibrated for this vulnerability. The vector AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N confirms the attack is strictly local, requires passive user interaction (opening the file), and produces only limited availability impact confined to the NanaZip process - no confidentiality or integrity impact, no subsequent-system effect. No EPSS score is available in the provided data, and the vulnerability does not appear in CISA KEV, meaning no confirmed active exploitation has been documented. No public POC has been referenced. The DoS outcome (process termination or memory exhaustion) is real but non-persistent and does not escalate to code execution; a victim simply restarts NanaZip. For enterprise defenders, this is a low-priority patch: the affected archive formats (UFS/FFS) are Unix filesystem images rarely encountered in Windows workflows, substantially limiting organic exposure. The primary risk vector is targeted social engineering, not opportunistic mass exploitation.

An attacker crafts a minimal UFS disk image - potentially only a few hundred bytes - embedding an fs_fsize value near the 32-bit maximum and delivers it to a target via phishing email, malicious download site, or shared network folder. When the victim opens or attempts to extract the image in NanaZip prior to 6.5.1749.0, the handler multiplies the attacker-controlled fragment size into allocation requests, exhausting available process memory and terminating NanaZip without any broader system impact. No public exploit code has been identified at time of analysis.