CVEFinder.io

CVE-2026-44215

đŸ”ļ medium
🔍 Scan for this CVE
Summary

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0.

CVSS Score
4.4
Medium
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-12
First Seen: 2026-05-17
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 11.6% of all 321,566 vulnerabilities in our database.

#284,280
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: May 13, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-05-14
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE IDs (Weakness Types)
CWE-787

đŸ“Ļ Affected Products 1

Vendor Product Status Affected Versions
m2team nanazip Affected
> 5.0.1252.0 < 6.0.1698.0

🔗 References 1

https://github.com/M2Team/NanaZip/security/advisorie...
Exploit Mitigation Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42444 ℹī¸ low 3.3 0.0 NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists i... 2026-05-12
CVE-2026-42445 ℹī¸ low 3.3 0.0 NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability ex... 2026-05-12
CVE-2026-42446 đŸ”ļ medium 4.4 0.0 NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in... 2026-05-12
CVE-2026-42355 ℹī¸ low 3.3 0.0 NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability ex... 2026-05-12
CVE-2026-42442 ℹī¸ low 3.3 0.0 NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the U... 2026-05-12
CVE-2026-42443 ℹī¸ low 3.3 0.0 NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UF... 2026-05-12
These CVEs affect the same products