CVE-2026-27014: NanZip has ROMFS Archive Infinite Loop / Stack Overflow

Q: What is the severity of CVE-2026-27014?

CVE-2026-27014 is classified as a high-severity vulnerability due to the potential for infinite loops and stack overflow.

Q: How do I fix CVE-2026-27014?

To address CVE-2026-27014, upgrade NanaZip to version 6.0.1630.0 or later.

Q: What versions of NanaZip are affected by CVE-2026-27014?

CVE-2026-27014 affects NanaZip versions from 5.0.1252.0 up to, but not including, 6.0.1630.0.

Q: What types of issues does CVE-2026-27014 cause?

CVE-2026-27014 can cause infinite loops and stack overflow from deeply nested directories in ROMFS archives.

Q: Is CVE-2026-27014 a remote or local exploit?

CVE-2026-27014 can be exploited locally when processing certain malformed ROMFS archive files.

Published Feb 19, 2026

Updated

NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular NextOffset chains cause an infinite loop, and deeply nested directories cause unbounded recursion (stack overflow) in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.

Affected Software

2 affected components

NanaZip NanaZip>5.0.1252.0<=6.0.1630.0

M2team Nanazip>=5.0.1252.0<6.0.1630.0

Event History

Feb 19, 2026

CVE Published

via MITRE·08:45 PM

Data Sourced

via MITRE·08:45 PM

DescriptionWeakness

Data Sourced

via NVD·09:18 PM

DescriptionSeverityWeaknessAffected Software

Apr 14, 58110

Event

via NVD·07:40 AM

Frequently Asked Questions

What is the severity of CVE-2026-27014?

CVE-2026-27014 is classified as a high-severity vulnerability due to the potential for infinite loops and stack overflow.

How do I fix CVE-2026-27014?

To address CVE-2026-27014, upgrade NanaZip to version 6.0.1630.0 or later.

What versions of NanaZip are affected by CVE-2026-27014?