CVE-2026-42442 LOW

CVE-2026-42442: NanaZip: Null-pointer dereference in NanaZip UFS parser when root inode is a symlink

Vendor M2Team
Product NanaZip
Weakness CWE-476
Published May 12, 2026
Last update May 13, 2026
View on NVD All CVEs

CVSS base score

3.3/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats the root inode as a directory without checking its type, and when the symlink has an embedded target (small di_size), the directory data buffer is zero-length, causing a null-pointer dereference on the first read. This vulnerability is fixed in 6.0.1698.0.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 13, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-3238 Samba: denial of service against ad dc wins server CVE-2026-9743 Aggregation sub-pipeline null dereference may allow DoS via crafted getMore CVE-2026-42766 Possible NULL Dereference in Password-Based CMS Decryption CVE-2026-46527 cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash CVE-2026-9567 GPAC MP4Box isom_intern.c MergeFragment null pointer dereference