CVE-2026-42442 Details
Description
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats the root inode as a directory without checking its type, and when the symlink has an embedded target (small di_size), the directory data buffer is zero-length, causing a null-pointer dereference on the first read. This vulnerability is fixed in 6.0.1698.0.
A null-pointer dereference vulnerability has been identified in NanaZip versions 5.0.1252.0 prior to 6.0.1698.0. The issue arises in the UFS/UFS2 filesystem image parser when a crafted UFS image is opened with the root inode (inode 2) set as a symlink instead of a directory. The parser fails to verify the inode type, treating it as a directory, which leads to a crash when the symlink's embedded target creates a zero-length buffer. This vulnerability causes an immediate crash, but does not allow code execution, as the dereference occurs at a null address, unmapped in modern operating systems.
Users can upgrade to NanaZip version 6.0.1698.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-8r4x-fx3w-ph77 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| m2team nanazip | >= 5.0.1250.0, < 6.0.1698.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | [email protected] |