CVE-2026-42444— NanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCount
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42444
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCount
Source: NVD (National Vulnerability Database)
Vulnerability Description
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then iterates BlockCount times, allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 billion heap allocations, exhausting available memory. This vulnerability is fixed in 6.0.1698.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)
Vulnerability Title
NanaZip 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NanaZip是M2-Team开源的一个压缩软件。 NanaZip 5.0.1252.0版本至6.0.1698.0之前版本存在安全漏洞，该漏洞源于littlefs文件系统镜像解析器的Open方法直接读取攻击者控制的BlockCount值而不进行验证，迭代分配文件路径条目，可能导致内存耗尽。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-42444
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42444
请登录查看更多情报信息。
- https://github.com/M2Team/NanaZip/security/advisories/GHSA-7hqh-mq57-wjmqx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-42444
Same Patch Batch · M2Team · 2026-05-12 · 7 CVEs total
| CVE-2026-42446 | 4.4 MEDIUM | NanaZip: Stack out-of-bounds read in NanaZip ZealFS bitmap parser |
| CVE-2026-44215 | 4.4 MEDIUM | NanaZip: Heap out-of-bounds write in NanaZip UFS directory parser |
| CVE-2026-42355 | 3.3 LOW | NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion |
| CVE-2026-42442 | 3.3 LOW | NanaZip: Null-pointer dereference in NanaZip UFS parser when root inode is a symlink |
| CVE-2026-42443 | 3.3 LOW | NanaZip: Integer divide-by-zero in NanaZip UFS inode offset calculation |
| CVE-2026-42445 | 3.3 LOW | NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion |
IV. Related Vulnerabilities
Same product: NanaZip
- CVE-2026-44215
NanaZip: Heap out-of-bounds write in NanaZip UFS directory p - CVE-2026-42445
NanaZip: Uncontrolled recursion in NanaZip UFS directory tra - CVE-2026-42443
NanaZip: Integer divide-by-zero in NanaZip UFS inode offset - CVE-2026-42442
NanaZip: Null-pointer dereference in NanaZip UFS parser when - CVE-2026-42355
NanaZip: Uncontrolled recursion in NanaZip Electron ASAR par
Same vendor: M2Team
- CVE-2026-44215
NanaZip: Heap out-of-bounds write in NanaZip UFS directory p - CVE-2026-42445
NanaZip: Uncontrolled recursion in NanaZip UFS directory tra - CVE-2026-42443
NanaZip: Integer divide-by-zero in NanaZip UFS inode offset - CVE-2026-42442
NanaZip: Null-pointer dereference in NanaZip UFS parser when - CVE-2026-42355
NanaZip: Uncontrolled recursion in NanaZip Electron ASAR par
Same weakness: CWE-770
- CVE-2021-47959
WordPress Plugin WPGraphQL 1.3.5 Denial of Service - CVE-2026-44679
Tuist: Forgot password flow lacks throttling for reset email - CVE-2026-44216
Wasmtime: Panic when allocating a table exceeding the size o - CVE-2026-8468
Unbounded buffer accumulation in multipart header parsing ca - CVE-2025-14870
Allocation of Resources Without Limits or Throttling in GitL
V. Comments for CVE-2026-42444
No comments yet