CVE-2026-42445: GHSL-2026-124_GHSL-2026-134: Memory corruption, information disclosure, and denial of service in NanaZip - CVE-2026-54616, CVE-2026-44215, CVE-2026-47222, CVE-2026-47223, CVE-2026-42446, CVE-2026-47224, CVE-2026-42442, CVE-2026-42443, CVE-2026-42445, CVE-2026-42355, CVE-2026-42444
NanaZip contains memory-safety, parsing, and resource-exhaustion vulnerabilities that can cause memory corruption, information disclosure, or denial of service.
Other sources
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanaZipto a version that resolves this vulnerability.Fixed in 6.0.1698.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42445?
CVE-2026-42445 is considered a medium severity vulnerability due to its potential for causing stack exhaustion and application crashes.
How do I fix CVE-2026-42445?
To fix CVE-2026-42445, update NanaZip to version 6.0.1698.0 or later.
What type of vulnerability is CVE-2026-42445?
CVE-2026-42445 is an uncontrolled recursion vulnerability that leads to stack exhaustion.
What versions of NanaZip are affected by CVE-2026-42445?
NanaZip versions from 5.0.1252.0 to before 6.0.1698.0 are affected by CVE-2026-42445.
How does CVE-2026-42445 affect the NanaZip application?
CVE-2026-42445 can cause the NanaZip application to experience stack exhaustion, leading to crashes during directory traversal operations.