CVE-2026-42444

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then iterates BlockCount times, allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 billion heap allocations, exhausting available memory. This vulnerability is fixed in 6.0.1698.0.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/M2Team/NanaZip/security/advisories/GHSA-7hqh-mq57-wjmq	Mitigation Vendor Advisory
https://github.com/M2Team/NanaZip/security/advisories/GHSA-7hqh-mq57-wjmq	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) NanaZip es un archivador de archivos de código abierto. Desde 5.0.1252.0 hasta antes de 6.0.1698.0, existe una vulnerabilidad de denegación de servicio en el analizador de imágenes del sistema de archivos littlefs en NanaZip. El método Open del gestor lee BlockCount directamente del superbloque controlado por el atacante sin ninguna validación contra el tamaño real del archivo o cualquier límite superior, luego itera BlockCount veces, asignando una entrada de ruta de archivo por iteración. Una imagen littlefs manipulada de 44 bytes con BlockCount = 0xFFFFFFFF provoca aproximadamente 4 mil millones de asignaciones de memoria dinámica, agotando la memoria disponible. Esta vulnerabilidad se corrige en 6.0.1698.0.

Information

Published : 2026-05-12 20:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42444

Mitre link : CVE-2026-42444

CVE.ORG link : CVE-2026-42444

JSON object : View

Products Affected

m2team

nanazip

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-42444", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42444", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T19:16:20.813157Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "M2Team", "product": "NanaZip", "versions": [{"status": "affected", "version": ">= 5.0.1250.0, < 6.0.1698.0"}]}]}], "published": "2026-05-12T20:16:41.653", "references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-7hqh-mq57-wjmq", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-7hqh-mq57-wjmq", "tags": ["Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then iterates BlockCount times, allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 billion heap allocations, exhausting available memory. This vulnerability is fixed in 6.0.1698.0."}, {"lang": "es", "value": "NanaZip es un archivador de archivos de c\u00f3digo abierto. Desde 5.0.1252.0 hasta antes de 6.0.1698.0, existe una vulnerabilidad de denegaci\u00f3n de servicio en el analizador de im\u00e1genes del sistema de archivos littlefs en NanaZip. El m\u00e9todo Open del gestor lee BlockCount directamente del superbloque controlado por el atacante sin ninguna validaci\u00f3n contra el tama\u00f1o real del archivo o cualquier l\u00edmite superior, luego itera BlockCount veces, asignando una entrada de ruta de archivo por iteraci\u00f3n. Una imagen littlefs manipulada de 44 bytes con BlockCount = 0xFFFFFFFF provoca aproximadamente 4 mil millones de asignaciones de memoria din\u00e1mica, agotando la memoria disponible. Esta vulnerabilidad se corrige en 6.0.1698.0."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60D88926-2653-48FD-A4FE-B8CB8EB39E55", "versionEndExcluding": "6.0.1698.0", "versionStartIncluding": "5.0.1252.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}