CVE-2026-42442

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats the root inode as a directory without checking its type, and when the symlink has an embedded target (small di_size), the directory data buffer is zero-length, causing a null-pointer dereference on the first read. This vulnerability is fixed in 6.0.1698.0.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/M2Team/NanaZip/security/advisories/GHSA-8r4x-fx3w-ph77	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) NanaZip es un archivador de código abierto. Desde la 5.0.1252.0 hasta antes de la 6.0.1698.0, existe una desreferencia de puntero nulo en el analizador de imágenes de sistemas de archivos UFS/UFS2 en NanaZip. La vulnerabilidad se activa al abrir una imagen UFS especialmente diseñada donde el inodo raíz (inodo 2) está configurado como IFLNK (enlace simbólico) en lugar de IFDIR (directorio). El analizador trata incondicionalmente el inodo raíz como un directorio sin verificar su tipo, y cuando el enlace simbólico tiene un destino incrustado (di_size pequeño), el búfer de datos del directorio es de longitud cero, lo que provoca una desreferencia de puntero nulo en la primera lectura. Esta vulnerabilidad está corregida en la 6.0.1698.0.

Information

Published : 2026-05-12 20:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42442

Mitre link : CVE-2026-42442

CVE.ORG link : CVE-2026-42442

JSON object : View

Products Affected

m2team

nanazip

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-42442", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42442", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:43:15.494462Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "M2Team", "product": "NanaZip", "versions": [{"status": "affected", "version": ">= 5.0.1250.0, < 6.0.1698.0"}]}]}], "published": "2026-05-12T20:16:41.393", "references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-8r4x-fx3w-ph77", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats the root inode as a directory without checking its type, and when the symlink has an embedded target (small di_size), the directory data buffer is zero-length, causing a null-pointer dereference on the first read. This vulnerability is fixed in 6.0.1698.0."}, {"lang": "es", "value": "NanaZip es un archivador de c\u00f3digo abierto. Desde la 5.0.1252.0 hasta antes de la 6.0.1698.0, existe una desreferencia de puntero nulo en el analizador de im\u00e1genes de sistemas de archivos UFS/UFS2 en NanaZip. La vulnerabilidad se activa al abrir una imagen UFS especialmente dise\u00f1ada donde el inodo ra\u00edz (inodo 2) est\u00e1 configurado como IFLNK (enlace simb\u00f3lico) en lugar de IFDIR (directorio). El analizador trata incondicionalmente el inodo ra\u00edz como un directorio sin verificar su tipo, y cuando el enlace simb\u00f3lico tiene un destino incrustado (di_size peque\u00f1o), el b\u00fafer de datos del directorio es de longitud cero, lo que provoca una desreferencia de puntero nulo en la primera lectura. Esta vulnerabilidad est\u00e1 corregida en la 6.0.1698.0."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DA72AE3-0544-433D-9DF5-7FC8DFDDF3C2", "versionEndExcluding": "6.0.1698.0", "versionStartIncluding": "5.0.1250.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}