CVE-2026-54616

{"id": "CVE-2026-54616", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54616", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:52:01.141088Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "M2Team", "product": "NanaZip", "versions": [{"status": "affected", "version": ">= 1.0.88.0, < 6.0.1698.0"}, {"status": "affected", "version": ">= 6.5.1638.0, < 6.5.1742.0"}]}]}], "published": "2026-08-20T17:18:18.090", "references": [{"url": "https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0."}], "lastModified": "2026-08-20T20:17:34.867", "sourceIdentifier": "security-advisories@github.com"}