CVE-2026-42445 LOW

CVE-2026-42445: NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion

Vendor M2Team
Product NanaZip
Weakness CWE-674
Published May 12, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

3.3/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 14, 2026 Record updated