CVE-2026-42445

Published May 12th, 2026

View on NVD ↗

CVSS v3

3.3

LOW

CVSS v2

N/A

Affected

PROJECT

Description

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

M2Team/NanaZip

The 7-Zip derivative intended for the modern Windows experience

GitHub

14.5K