Read the docs
TI-2026-21488 Aliases CVE-2026-27014

NanZip has ROMFS Archive Infinite Loop / Stack Overflow

Priority MEDIUM 56CWE-674Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and deeply nested directories cause unbounded recursion (stack overflow) in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed NanaZip (M2Team): 6.0.1630.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
M2TeamNanaZip5.0.1252.0 to before 6.0.1630.06.0.1630.0Patch availableCNA
  • NanaZip VendorM2Team Affected 5.0.1252.0 to before 6.0.1630.0 Fixed in 6.0.1630.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*5.0.1252.0 to before 6.0.1630.0VulnerableM2Team
  • cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:* Versions 5.0.1252.0 to before 6.0.1630.0 Vulnerable ·M2Team

Remediation

  • Fix · CNA NanaZip (M2Team) Fixed in 6.0.1630.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27014

References

Exploit 1

  • TI-2026-32194 NanaZip: Heap out-of-bounds write in NanaZip UFS directory parser CVSS 3.1HIGH 7.1
  • TI-2026-30733 NanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCount CVSS 3.1MEDIUM 5.5
  • TI-2026-21251 NanaZip has DotNet Single file OOB Heap Read CVSS 4.0MEDIUM 5.2
  • TI-2026-22087 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length CVSS 4.0MEDIUM 5.1
  • TI-2026-22086 NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS) CVSS 4.0MEDIUM 5.1
  • TI-2026-22085 NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength CVSS 4.0MEDIUM 5.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences