CVE-2026-42443 Details
Description
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero. The parser uses this attacker-controlled value as a divisor without validation, causing an immediate hardware trap and process crash. This vulnerability is fixed in 6.0.1698.0.
A divide-by-zero vulnerability has been identified in NanaZip versions 5.0.1252.0 prior to 6.0.1698.0, specifically within the UFS/UFS2 filesystem image parser. The issue arises when a crafted UFS image is opened, with the superblock field 'fs_ipg' (inodes per cylinder group) set to zero. This unvalidated, attacker-controlled value is used as a divisor, leading to a hardware trap and a crash of the NanaZip process. The vulnerability is present in the function 'GetInodeOffset', where the division by 'fs_ipg' is executed without any prior validation, causing an immediate hardware exception that terminates the process.
Users can upgrade to NanaZip version 6.0.1698.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-3x2h-gqqw-g3gm | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-369 | Divide By Zero | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| m2team nanazip | >= 5.0.1252.0, < 6.0.1698.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| May 12, 2026 | New CVE Received | [email protected] |