CVE-2026-42445

LOW3.3

NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion

Published May 12, 2026

Modified 3 days ago

Details

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

References

WEB

https://github.com/M2Team/NanaZip/security/advisories/GHSA-jpf5-j78p-cp3x

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-42445

CVSS Analysis

CVSS v3.1

3.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

3.3/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness Type (CWE)

Other

CWE-674

Ecosystems

Timeline

PublishedMay 12, 2026

ModifiedMay 12, 2026