CVE-2026-26282 MEDIUM

CVE-2026-26282: NanaZip has DotNet Single file OOB Heap Read

Vendor M2Team

Product NanaZip

Weakness CWE-126

Published February 19, 2026

Last update February 20, 2026

View on NVD All CVEs

CVSS base score

5.2/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single File` bundle header parser due to missing bounds check. Opening a crafted file with NanaZip causes a crash or leaks heap data to the user. Version 6.0.1630.0 patches the issue.

Key dates

02Disclosure timeline

February 19, 2026 CVE published

February 20, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-26282 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/126.html