Out-of-bounds Read in M2team Nanazip

CVE-2026-54616

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Vulnerability class: Buffer Overflow

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L.

EPSS exploit prediction

EPSS: 0.004 (36.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-54616: held from 0.003 to 0.004.

EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001

Affected products

  • M2team Nanazip — versions >= 1.0.88.0, < 6.0.1698.0, >= 6.5.1638.0, < 6.5.1742.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-54616?
CVE-2026-54616 is a high-severity vulnerability in M2team Nanazip, classified under Out-of-bounds Read. CVSS score: 7.1/10. Published 2026-08-20.
How severe is CVE-2026-54616?
High severity. CVSS v3 base score is 7.1 out of 10.