CVE-2026-44215: M2team NanaZip Buffer Overflow Vulnerability

CVE-2026-44215 Overview

CVE-2026-44215 is a heap out-of-bounds write vulnerability in NanaZip, an open source file archive utility for Windows. The flaw resides in the Unix File System (UFS/UFS2) filesystem image parser. Versions from 5.0.1252.0 up to but not including 6.0.1698.0 are affected. The vulnerability triggers when a user opens a crafted UFS filesystem image. An attacker controls the byte offset of a one-byte null write within an approximately 254-byte window past the heap allocation boundary. The issue is fixed in NanaZip 6.0.1698.0 and is tracked under CWE-787.

Critical Impact
Opening a malicious UFS image in a vulnerable NanaZip build can corrupt adjacent heap memory, leading to application crashes and potential integrity loss.

Affected Products

NanaZip 5.0.1252.0 through versions prior to 6.0.1698.0
M2Team NanaZip on Windows platforms
Any Windows shell integration using vulnerable NanaZip builds for UFS extraction

Discovery Timeline

2026-05-12 - CVE-2026-44215 published to the National Vulnerability Database
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-44215

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] within the UFS/UFS2 filesystem image parser. NanaZip allocates a buffer to process metadata from the UFS image, but the parser fails to validate an offset value extracted from attacker-controlled fields. When the parser writes a single null byte, it can target a location up to approximately 254 bytes past the end of the heap allocation. The attacker chooses the offset within that window by manipulating fields in the crafted filesystem image.

A one-byte null write may appear minor, but heap metadata, pointers, and adjacent object fields commonly reside within a 254-byte adjacency range. Corrupting the low byte of a pointer or length field can redirect later reads or writes. Exploitation requires user interaction: the victim must open the malicious archive. The flaw produces high availability impact and low integrity impact, with no confidentiality exposure per the CVSS vector.

Root Cause

The parser trusts size or offset metadata sourced from the UFS image without bounding it against the destination heap allocation. Missing boundary validation allows a write index to exceed the allocation length by up to 254 bytes.

Attack Vector

An attacker delivers a crafted UFS or UFS2 filesystem image to a victim through email, web download, or file share. The victim opens the file with a vulnerable NanaZip build. Parsing the malicious image triggers the out-of-bounds null write. No authentication is required, and the attack is reachable over the network through standard file delivery channels.

No public proof-of-concept code has been published. See the NanaZip GitHub Security Advisory GHSA-44wh-7gc3-w936 for vendor technical details.

Detection Methods for CVE-2026-44215

Indicators of Compromise

NanaZip process crashes or unexpected terminations shortly after opening archive or image files
Presence of .ufs, .ufs2, or unlabeled disk image files received from untrusted sources
Windows Error Reporting entries citing heap corruption in NanaZip.exe or its shell extension

Detection Strategies

Inventory installed NanaZip versions across endpoints and flag any build below 6.0.1698.0
Monitor for application faults in NanaZip.exe with exception codes indicating heap corruption such as 0xC0000374
Alert on UFS filesystem images arriving through email gateways or web proxies when they are not expected in the environment

Monitoring Recommendations

Forward Windows Application event logs and WER crash telemetry to a centralized analytics platform for correlation
Track child process activity and memory anomalies originating from archive utilities handling untrusted input
Review software inventory reports weekly to confirm NanaZip remains at the patched version

How to Mitigate CVE-2026-44215

Immediate Actions Required

Upgrade NanaZip to version 6.0.1698.0 or later on all affected Windows systems
Block delivery of UFS and UFS2 filesystem images at email and web gateways unless required for business operations
Instruct users not to open archive or disk image files received from untrusted sources

Patch Information

M2Team has released NanaZip 6.0.1698.0, which fixes the UFS/UFS2 parser bounds checking. Patch details and source changes are documented in the GitHub Security Advisory GHSA-44wh-7gc3-w936. Administrators should obtain the update through the Microsoft Store or the official NanaZip GitHub releases page.

Workarounds

Uninstall NanaZip until the patched version can be deployed if immediate upgrade is not feasible
Disable NanaZip shell integration to prevent automatic preview or extraction of UFS images via Windows Explorer
Open untrusted archives only inside an isolated virtual machine or sandbox environment

bash

# Verify installed NanaZip version on Windows via PowerShell
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version

# Remove vulnerable NanaZip installation if patching is delayed
Get-AppxPackage -Name "*NanaZip*" | Remove-AppxPackage