Out-of-bounds Read in M2team Nanazip

CVE-2026-27711

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted `.ufs/.ufs2/.img` file to trigger out-of-bou…

Vulnerability class: Buffer Overflow

EPSS: 0.000 (5.9th percentile) — read the EPSS interpretation.

Affected products

  • M2team Nanazip — versions >= 5.0.1252.0, < 6.0.1638.0, >= 6.1, < 6.5.1638.0

Weakness classification (CWE)

References