CVE-2026-27711

Executive Summary

CVE-2026-27711 is a memory corruption vulnerability in NanaZip, an open-source file archiver for Windows. The flaw resides in the UFS (Universal File System) parser, which is used to handle .ufs, .ufs2, and .img file formats. An attacker can craft a malicious archive file that, when opened or listed by a user, triggers an out-of-bounds memory access. This can lead to a process crash, hang, or potentially exploitable heap corruption. The vulnerability affects versions starting from 5.0.1252.0 up to, but not including, the patched versions 6.0.1638.0 and 6.5.1638.0. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the description, a reasonable assessment would be:

• Attack Vector (AV): Local (L) – requires user to open a file.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – user-level access.
• User Interaction (UI): Required (R) – victim must open the file.
• Scope (S): Unchanged (U) – vulnerability affects the application only.
• Confidentiality (C): High (H) – potential for memory read.
• Integrity (I): High (H) – potential for memory write.
• Availability (A): High (H) – crash or hang.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Estimated Score: 7.8 (High)

Threat Level: High. While no active exploitation is reported, the vulnerability is reachable via normal user interaction and can lead to code execution.

Deep Dive & Mechanics

The vulnerability is a classic out-of-bounds (OOB) memory access in the UFS parser. UFS is a file system format used in some disk images and archive files. The parser likely fails to properly validate the size or offset fields within the file header or metadata structures.

Root Cause: When parsing a crafted .ufs file, the code reads a length or offset value from the file without proper bounds checking. This value is then used to index into a heap buffer, causing a read or write beyond the allocated memory.

Impact:

• Crash/Hang: The OOB access can cause an access violation, leading to a process crash or infinite loop.
• Heap Corruption: If the OOB access is a write, it can corrupt adjacent heap metadata, potentially leading to arbitrary code execution.

Attack Vector: The attacker must convince the victim to open a malicious archive file (e.g., via email, download, or USB). No special privileges are required.

Vulnerable vs. Patched Code

No specific code diff is available. However, the fix likely involves adding bounds checks before memory operations. A hypothetical vulnerable code pattern:

// Vulnerable code
uint32_t offset = ReadUInt32(file);
uint32_t size = ReadUInt32(file);
char* buffer = new char[size];
ReadFile(file, buffer, size); // No check on offset
ProcessData(buffer + offset, size); // OOB if offset > size

Patched code would include:

// Patched code
uint32_t offset = ReadUInt32(file);
uint32_t size = ReadUInt32(file);
if (offset > size) {
    // Handle error
    return ERROR_INVALID_DATA;
}
char* buffer = new char[size];
ReadFile(file, buffer, size);
ProcessData(buffer + offset, size - offset);

Exploitation & Lab Setup

Red Team

Objective: Exploit the vulnerability to achieve code execution.

Setup:

1. Environment: Windows 10/11 with NanaZip version 5.0.1252.0 to 6.0.1637.0.
2. Tooling: Python 3, a hex editor, and a debugger (WinDbg or x64dbg).

Steps:

1. Craft Malicious File: Create a .ufs file with a malformed header. For example, set the offset field to a value larger than the declared size.
2. Deliver Payload: Send the file to the victim via email or share it.
3. Trigger: Victim opens the file in NanaZip (e.g., double-click or right-click > Open).
4. Exploit: The OOB write corrupts a function pointer or heap metadata. Use heap spraying to control the corrupted data and redirect execution to shellcode.

Note: No public exploit code is available. This is a theoretical approach.

Blue Team

Objective: Detect and prevent exploitation.

Detection:

• Monitor for crashes of NanaZip.exe with access violation exceptions.
• Use Sysmon to log process creation and file access events.
• Deploy EDR rules for heap corruption indicators.

Prevention:

• Update NanaZip to version 6.0.1638.0 or later.
• Use application whitelisting to block untrusted executables.
• Enable Windows Defender Exploit Guard (Heap corruption protection).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): Unknown (no samples available).
• File Names: *.ufs, *.ufs2, *.img with unusual sizes or headers.
• Process Behavior: NanaZip.exe crashes with 0xC0000005 (Access Violation).
• Network: No network indicators (local file-based).
• Registry: No known persistence mechanisms.

Detection Engineering

YARA Rule

rule CVE_2026_27711_UFS_OOB {
    meta:
        description = "Detects malicious UFS files exploiting CVE-2026-27711"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $ufs_magic = { 55 46 53 20 } // "UFS " magic bytes
        $ufs2_magic = { 55 46 53 32 } // "UFS2"
    condition:
        ($ufs_magic at 0 or $ufs2_magic at 0) and
        filesize < 10MB and
        // Check for suspicious offset/size fields (heuristic)
        uint32(8) > uint32(12) // offset > size
}

Sigma Rule

title: NanaZip UFS Parser Memory Corruption
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes of NanaZip.exe due to CVE-2026-27711
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\NanaZip.exe'
        ExitCode: 0xC0000005
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-27711 NanaZip UFS OOB Attempt"; flow:to_server,established; content:"|55 46 53 20|"; offset:0; depth:4; content:"|55 46 53 32|"; offset:0; depth:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update NanaZip to version 6.0.1638.0 or 6.5.1638.0.
2. Workaround: Do not open .ufs, .ufs2, or .img files from untrusted sources.
3. Detection: Deploy the YARA and Sigma rules above.
4. Monitoring: Enable application crash logging and review for NanaZip.exe crashes.
5. User Training: Educate users on the risks of opening unknown archive files.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert