Out-of-Bounds Heap Read in NanaZip File Archiving Software

CVE-2026-26282

What is CVE-2026-26282?

NanaZip, an open-source file archiving tool, is affected by an out-of-bounds heap read exploit that occurs in the .NET Single File bundle header parser. This vulnerability, present in versions prior to 6.0.1630.0, arises due to a missing bounds check, which allows attackers to craft malicious files that can trigger crashes or leak sensitive heap data to users. It is crucial for users to update to version 6.0.1630.0 to mitigate this issue. For more information, see the security advisory and proof of concept linked below.

References