CVE-2026-54616: NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value

Published Aug 20, 2026
·
Updated

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4decompresssafe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Affected Software

2 affected components
NanaZip NanaZip>1.0.88.0<=6.0.1698.0
NanaZip NanaZip>=6.0.1698.0<=6.5.1742.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade NanaZip to a version that resolves this vulnerability.

    Fixed in 6.0.1698.0
  2. Upgrade

    Upgrade NanaZip to a version that resolves this vulnerability.

    Fixed in 6.5.1742.0

Event History

Aug 20, 2026
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What must an attacker provide to trigger the issue?

The attacker must persuade a user to process a malformed SquashFS archive containing LZ4-compressed data. Exploitation also relies on attacker-controlled inode offset values during fragment extraction.

2

What is the practical impact?

A successful trigger can cause NanaZip to read beyond a heap allocation. Adjacent heap contents may be included in an extracted file, and the process may also crash.

3

Which versions should be remediated?

Versions from 1.0.88.0 up to, but not including, stable 6.0.1698.0 are affected. Preview builds should be updated to 6.5.1742.0 or later; the issue is fixed in stable 6.0.1698.0 and preview 6.5.1742.0.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203