CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length

Medium 5.1 Published 25 Feb 2026 Updated 26 Feb 2026

A crafted UFS archive file can trigger memory corruption in NanaZip, potentially allowing code execution or crashing the application.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-27711?

CVE-2026-27711 is a medium-severity memory corruption vulnerability in M2Team NanaZip, published on 25 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a memory corruption vulnerability in NanaZip’s UFS parser allows a crafted `.ufs/.ufs2/.img` file to trigger out-of-bounds memory access during archive open/listing. The bug is reachable via normal user file-open flow and can cause process crash, hang, and potentially exploitable heap corruption. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.

Weakness: CWE-125

Which versions are affected by CVE-2026-27711?

It affects 1 product.

Products include M2team Nanazip.

How do I fix CVE-2026-27711?

No fix has been published for CVE-2026-27711 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-27711 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27711 exists.

Sources

Also known as GHSA-rjwv-4w7x-hc9c.