CVE-2026-27114 NanaZip has ROMFS Archive Infinite Loop
An attacker can cause a denial of service in NanaZip by providing a crafted ROMFS archive with circular offsets, leading to an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-27114?
CVE-2026-27114 is a medium-severity denial of service vulnerability in M2Team NanaZip, published on 19 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.
Weakness: CWE-835
Which versions are affected by CVE-2026-27114?
It affects 1 product.
Products include M2team Nanazip.
How do I fix CVE-2026-27114?
No fix has been published for CVE-2026-27114 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-27114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27114 exists.
Other vulnerabilities in M2Team NanaZip
- CVE-2026-26282 NanaZip has DotNet Single file OOB Heap Read
- CVE-2026-27709 NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength
- CVE-2026-27710 NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)
- CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length
- CVE-2026-27014 NanZip has ROMFS Archive Infinite Loop / Stack Overflow
Sources
Also known as GHSA-hfg9-6rf9-5pgx.