Stack-Based Out-of-Bounds Read in NanaZip File Archive by M2Team

CVE-2026-42446

What is CVE-2026-42446?

NanaZip, an open-source file archiving tool, contains a stack-based out-of-bounds read vulnerability within its ZealFS filesystem image parser. This issue arises when processing a specially crafted ZealFS v1 filesystem image, where an attacker can manipulate the BitmapSize field in the file header. This manipulation triggers an unbounded loop that reads beyond the allocated stack memory for the ZEALFS_V1_HEADER structure. The vulnerability has been addressed in version 6.0.1698.0. It is essential for users to update to the latest version to mitigate potential security risks.

References