CVE-2026-27709: NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s .NET Single File Application parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed RelativePathLength so the parser constructs a std::string from memory beyond HeaderBuffer, leading to crash and potential in-process memory disclosure. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27709?
CVE-2026-27709 has been classified as a medium severity vulnerability due to potential information exposure via an out-of-bounds read.
How do I fix CVE-2026-27709?
To fix CVE-2026-27709, update NanaZip to version 6.0.1638.0 or later.
What versions of NanaZip are affected by CVE-2026-27709?
CVE-2026-27709 affects NanaZip versions between 5.0.1252.0 and 6.0.1637.9.
What type of vulnerability is CVE-2026-27709?
CVE-2026-27709 is an out-of-bounds read vulnerability impacting the .NET Single-File Manifest Parser in NanaZip.
Who is the vendor for CVE-2026-27709?
The vendor for CVE-2026-27709 is M2Team, the company behind the NanaZip product.