CVE-2026-42444 NanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCount
Attackers can cause memory exhaustion and denial of service in NanaZip by providing a crafted littlefs image with an invalid block count.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-42444?
CVE-2026-42444 is a low-severity denial of service vulnerability in M2Team NanaZip, published on 12 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then iterates BlockCount times, allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 billion heap allocations, exhausting available memory. This vulnerability is fixed in 6.0.1698.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-42444?
It affects 1 product.
Products include M2team Nanazip.
How do I fix CVE-2026-42444?
No fix has been published for CVE-2026-42444 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42444 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42444 exists.
Other vulnerabilities in M2Team NanaZip
- CVE-2026-26282 NanaZip has DotNet Single file OOB Heap Read
- CVE-2026-27709 NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength
- CVE-2026-27710 NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)
- CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length
- CVE-2026-27014 NanZip has ROMFS Archive Infinite Loop / Stack Overflow
Sources
Also known as GHSA-7hqh-mq57-wjmq.