Out-of-Bounds Read in NanaZip Affects File Archive Operations

CVE-2026-27709

What is CVE-2026-27709?

NanaZip, an open source file archiving tool, contains an out-of-bounds read vulnerability in its '.NET Single File Application' parser. This issue arises when the parser handles a crafted bundle with a malformed 'RelativePathLength'. Consequently, the parser attempts to construct a 'std::string' from memory beyond the 'HeaderBuffer', which may lead to unexpected application crashes and potential exposure of sensitive in-process memory content. Users are advised to update to versions 6.0.1638.0 or 6.5.1638.0 to mitigate this vulnerability.

References