CVE-2026-27709 NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength

Medium 5.1 Published 25 Feb 2026 Updated 26 Feb 2026

Attackers can craft a malicious archive bundle to trigger an out-of-bounds read in NanaZip, potentially disclosing memory or causing a crash.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-27709?

CVE-2026-27709 is a medium-severity vulnerability in M2Team NanaZip, published on 25 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s `.NET Single File Application` parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed `RelativePathLength` so the parser constructs a `std::string` from memory beyond `HeaderBuffer`, leading to crash and potential in-process memory disclosure. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.

Weakness: CWE-125

Which versions are affected by CVE-2026-27709?

It affects 1 product.

Products include M2team Nanazip.

How do I fix CVE-2026-27709?

No fix has been published for CVE-2026-27709 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-27709 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27709 exists.

Sources

Also known as GHSA-vr4w-xc78-w6fv.