PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42444 M2Team CVE debrief

NanaZip versions 5.0.1252.0 through 6.0.1698.0 (exclusive) contain a denial-of-service vulnerability in the littlefs filesystem image parser. The Open method reads BlockCount directly from attacker-controlled superblock data without validating against actual file size or enforcing an upper bound, then iterates BlockCount times allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount set to 0xFFFFFFFF triggers approximately 4 billion heap allocations, exhausting system memory. This vulnerability was published on 2026-05-12 and last modified on 2026-05-18. CVSS 3.1 score is 3.3 (LOW severity). The issue is resolved in version 6.0.1698.0.

Vendor
M2Team
Product
NanaZip
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

End-users and administrators deploying NanaZip in environments where untrusted archive files may be processed. Security teams monitoring for denial-of-service conditions in file handling applications.

Technical summary

The littlefs filesystem image parser in NanaZip fails to validate the BlockCount field read from the superblock. An attacker can craft a minimal 44-byte image with BlockCount set to maximum value (0xFFFFFFFF), causing the parser to attempt ~4 billion heap allocations and exhaust available memory. The vulnerability is local, requires user interaction to open a malicious file, and results in low availability impact per CVSS scoring.

Defensive priority

medium

Recommended defensive actions

  • Upgrade NanaZip to version 6.0.1698.0 or later to remediate this vulnerability.
  • If upgrading is not immediately possible, avoid opening littlefs filesystem images from untrusted sources.
  • Monitor for unusual memory consumption when handling archive files, particularly littlefs images.

Evidence notes

Vendor advisory confirms the vulnerability exists in versions 5.0.1252.0 to before 6.0.1698.0, with fix released in 6.0.1698.0. CWE-770 (Allocation of Resources Without Limits or Throttling) is identified as the weakness.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42444 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42444

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42444 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42444

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.