CVE-2026-42445 — NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion

CVE-2026-42445

NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion PUBLISHED

Description (CNA)

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

Affected (CNA)

Vendor / product	Versions
M2Team / NanaZip	affected >= 5.0.1250.0, < 6.0.1698.0

CWE

CWE-674

References

https://github.com/M2Team/NanaZip/security/advisories/GHSA-jpf5-j78p-cp3x

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.