CVE-2026-42445: M2team NanaZip DoS Vulnerability

CVE-2026-42445 Overview

NanaZip is an open source file archive utility for Windows. CVE-2026-42445 is an uncontrolled recursion vulnerability [CWE-674] in the UFS/UFS2 filesystem image parser. The GetAllPaths function recurses into subdirectories without enforcing a depth limit or tracking visited inodes. A crafted UFS image containing a deeply nested directory tree or an inode cycle triggers stack exhaustion, crashing the NanaZip process. The flaw affects versions from 5.0.1252.0 up to but not including 6.0.1698.0. The vendor m2team fixed the issue in version 6.0.1698.0.

Critical Impact
Local attackers can crash the NanaZip process by enticing a user to open a malicious UFS or UFS2 archive, resulting in denial of service.

Affected Products

NanaZip versions 5.0.1252.0 through 6.0.1697.x
m2team NanaZip on Windows platforms
UFS and UFS2 filesystem image handling component

Discovery Timeline

2026-05-12 - CVE-2026-42445 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-42445

Vulnerability Analysis

The vulnerability resides in the UFS (Unix File System) and UFS2 filesystem image parser shipped with NanaZip. When the archiver enumerates filesystem contents, the GetAllPaths function traverses each directory entry and recurses into subdirectories. The parser performs neither depth bounding nor inode-visit tracking during traversal.

An attacker crafts a malicious UFS image that contains either an extremely deep directory hierarchy or a cyclic inode reference where a directory points back to one of its ancestors. When NanaZip processes the image, the recursion either descends indefinitely or expands the call stack until it exceeds the thread stack limit. The result is a stack overflow that terminates the NanaZip process.

Exploitation requires user interaction. A victim must open or browse the malicious archive within NanaZip. The attack vector is local, and impact is confined to availability of the NanaZip process. Confidentiality and integrity are not affected.

Root Cause

The root cause is missing recursion safety in the GetAllPaths traversal routine. The function lacks two defenses common in filesystem parsers: a maximum recursion depth and a set of visited inode identifiers. Without these checks, untrusted directory structures dictate the call depth, allowing adversary-controlled stack growth.

Attack Vector

An attacker distributes a malicious .ufs or .ufs2 image through email, file sharing, or web download. The victim opens the file with NanaZip. The parser invokes GetAllPaths, follows the crafted directory chain, exhausts the stack, and the process crashes. No elevated privileges are required by the attacker.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-jpf5-j78p-cp3x for vendor technical details.

Detection Methods for CVE-2026-42445

Indicators of Compromise

Unexpected NanaZip process crashes shortly after a user opens a .ufs or .ufs2 archive
Windows Application event log entries reporting faulting module within NanaZip with exception code 0xC00000FD (stack overflow)
Presence of UFS/UFS2 image files received from untrusted sources in user download or temporary directories

Detection Strategies

Inventory installed NanaZip versions across endpoints and flag any installation below 6.0.1698.0
Monitor endpoint telemetry for repeated NanaZip crash events correlated with archive file opens
Inspect inbound email and file transfer channels for UFS and UFS2 image attachments, which are uncommon in standard business workflows

Monitoring Recommendations

Collect Windows Error Reporting and application crash telemetry for the NanaZip.exe process
Alert on stack overflow exceptions (STATUS_STACK_OVERFLOW) originating from archive handler processes
Track software inventory changes to confirm patched versions are deployed and remain installed

How to Mitigate CVE-2026-42445

Immediate Actions Required

Upgrade all NanaZip installations to version 6.0.1698.0 or later
Instruct users to avoid opening UFS or UFS2 images received from untrusted sources until patching is complete
Review software distribution channels to ensure the patched release is delivered through managed deployment tools

Patch Information

The vendor m2team released the fix in NanaZip 6.0.1698.0. The patched GetAllPaths implementation enforces traversal safety to prevent uncontrolled recursion. Refer to the NanaZip GitHub Security Advisory GHSA-jpf5-j78p-cp3x for release details and download links.

Workarounds

Block or quarantine UFS and UFS2 file types at email gateways and web proxies where business need does not require them
Use application control policies to restrict NanaZip execution to vetted versions
Configure file association policies so that unfamiliar archive formats prompt explicit user confirmation before opening

bash

# Verify installed NanaZip version on Windows endpoints
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version

# Example: enforce minimum patched version
# Compare against required version 6.0.1698.0