CVE-2026-27711

EUVD-2026-8769
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted `.ufs/.ufs2/.img` file to trigger out-of-bounds memory access during archive open/listing. The bug is reachable via normal user file-open flow and can cause process crash, hang, and potentially exploitable heap corruption. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.6 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
m2teamnanazip
5.0.1252.0 ≤
𝑥
< 6.0.1638.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/M2Team/NanaZip/security/advisories/GHSA-rjwv-4w7x-hc9c
https://github.com/M2Team/NanaZip/security/advisories/GHSA-rjwv-4w7x-hc9c