← Vulnerability feed

Vulnerability record · CVE-2026-42444 · published 12 May 2026

CVE-2026-42444: M2team nanazip allocation without limits vulnerability

M2team · Nanazip

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then iterates BlockCount times, allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 billion heap allocations, exhausting available memory. This vulnerability is fixed in 6.0.1698.0.

5.5 CVSS 3.1 Medium EPSS 0.15% · top 96.6% CWE-770 · Allocation without limits
5.5CVSS 3.1 base score
0.15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then iterates BlockCount times, allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 billion heap allocations, exhausting available memory. This vulnerability is fixed in 6.0.1698.0.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/M2Team/NanaZip/security/advisories/GHSA-7hqh-mq57-wjmq MitigationVendor Advisory
https://github.com/M2Team/NanaZip/security/advisories/GHSA-7hqh-mq57-wjmq MitigationVendor Advisory

Track CVE-2026-42444 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.1CVE-2026-44215M2team nanazip out-of-bounds write vulnerabilityNanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesys…EPSS 0.26%7.1CVE-2026-42446M2team nanazip out-of-bounds read vulnerabilityNanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image …EPSS 0.16%5.5CVE-2026-42355M2team nanazip vulnerabilityNanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive …EPSS 0.15%5.5CVE-2026-42442M2team nanazip null pointer dereference vulnerabilityNanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image pars…EPSS 0.15%5.5CVE-2026-42443M2team nanazip divide by zero vulnerabilityNanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parse…EPSS 0.15%5.5CVE-2026-42445M2team nanazip vulnerabilityNanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesyst…EPSS 0.15%5.2CVE-2026-26282M2team nanazip out-of-bounds read vulnerabilityNanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NE…EPSS 0.16%5.1CVE-2026-27709M2team nanazip out-of-bounds read vulnerabilityNanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s `.NET Single File A…EPSS 0.16%

Source: NIST National Vulnerability Database (record CVE-2026-42444), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.