Read the docs
TI-2026-39447 Aliases CVE-2026-54616

NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Fixed NanaZip (M2Team): 6.0.1698.0, 6.5.1742.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
M2TeamNanaZip1.0.88.0 to before 6.0.1698.0; 6.5.1638.0 to before 6.5.1742.06.0.1698.0, 6.5.1742.0Patch availableCNA
  • NanaZip VendorM2Team Affected 1.0.88.0 to before 6.0.1698.0; 6.5.1638.0 to before 6.5.1742.0 Fixed in 6.0.1698.0, 6.5.1742.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*——M2Team
  • cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:* Versions — — ·M2Team

Remediation

  • Fix · CNA NanaZip (M2Team) Fixed in 6.0.1698.0, 6.5.1742.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54616

References

Other 5

  • TI-2026-32194 NanaZip: Heap out-of-bounds write in NanaZip UFS directory parser CVSS 3.1HIGH 7.1
  • TI-2026-34809 NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow CVSS 3.1MEDIUM 5.4
  • TI-2026-34808 NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser via unsigned integer underflow CVSS 3.1MEDIUM 5.4
  • TI-2026-30733 NanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCount CVSS 3.1MEDIUM 5.5
  • TI-2026-21251 NanaZip has DotNet Single file OOB Heap Read CVSS 4.0MEDIUM 5.2
  • TI-2026-22087 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length CVSS 4.0MEDIUM 5.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences