Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-54616: NanaZip may crash or expose data via crafted files
CVE-2026-54616 · published 2 months ago
Summary
Versions of NanaZip from 1.0.88.0 up to 6.0.1698.0 (and the preview 6.5.1742.0) can be tricked by a specially crafted archive file to read memory it shouldn't. This can cause the program to crash or insert unexpected data into the extracted file. Update NanaZip to version 6.0.1698.0 or later (or the preview 6.5.1742.0) to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| m2team | nanazip | >= 1.0.88.0, < 6.0.1698.0 |
Original advisory text
NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54616... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-54616 Vendor Advisory
- https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0 URL
- https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp Vendor Advisory
- https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0 URL
- https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952... Patch
- https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c782695... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published20 Aug 2026
Updated4 Nov 2026
First seen20 Aug 2026
Track software like this
Free during beta