Null-Pointer Dereference in NanaZip File Archive Tool

CVE-2026-42442

What is CVE-2026-42442?

A null-pointer dereference exists in NanaZip, an open-source file archiving tool. This vulnerability occurs when opening a specially crafted UFS image, which sets the root inode to IFLNK (symbolic link) rather than IFDIR (directory). The parser mistakenly treats this symlink as a directory without verifying its type. If the embedded target of the symlink is small, the resulting directory data buffer will be empty, leading to a null-pointer dereference during the first read operation. This can potentially crash the application, allowing for denial-of-service conditions. The issue has been resolved in version 6.0.1698.0.

References