CVE-2026-42445: NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42445?
CVE-2026-42445 is considered a medium severity vulnerability due to its potential for causing stack exhaustion and application crashes.
How do I fix CVE-2026-42445?
To fix CVE-2026-42445, update NanaZip to version 6.0.1698.0 or later.
What type of vulnerability is CVE-2026-42445?
CVE-2026-42445 is an uncontrolled recursion vulnerability that leads to stack exhaustion.
What versions of NanaZip are affected by CVE-2026-42445?
NanaZip versions from 5.0.1252.0 to before 6.0.1698.0 are affected by CVE-2026-42445.
How does CVE-2026-42445 affect the NanaZip application?
CVE-2026-42445 can cause the NanaZip application to experience stack exhaustion, leading to crashes during directory traversal operations.