CVE-2026-42445

Executive Summary

CVE-2026-42445 is a denial-of-service (DoS) vulnerability in NanaZip, an open-source file archiver. The flaw resides in the UFS/UFS2 filesystem image parser, specifically in the GetAllPaths function, which recursively traverses directory structures without any depth limit or visited-inode tracking. An attacker can craft a malicious UFS image containing a deeply nested directory tree or an inode cycle, causing stack exhaustion and crashing the NanaZip process. The vulnerability affects versions from 5.0.1252.0 up to (but not including) 6.0.1698.0. The CVSS score is 3.3 (Low), reflecting the local attack vector and the requirement for user interaction (opening a malicious archive). No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. The vendor has released a fix in version 6.0.1698.0.

Supply Chain & Package Security

NanaZip is distributed as a standalone application, not as a package in NPM, PyPI, Go, or Ruby registries. Therefore, supply chain risks are limited to the integrity of the download source (e.g., GitHub releases, official website). Users should ensure they download the patched version from the official repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Base Score: 3.3 (Low)
• Attack Vector (AV): Local (L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious archive.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – The application crashes, causing a denial of service.

Threat Level: Low. Exploitation requires user interaction and only results in a crash. No remote code execution or data theft is possible.

Deep Dive & Mechanics

The vulnerability is a classic uncontrolled recursion (CWE-674) in the UFS/UFS2 filesystem image parser. The GetAllPaths function is designed to enumerate all file paths within a UFS image. It does so by recursively calling itself for each subdirectory encountered.

Root Cause: The function lacks two critical safeguards:

1. Depth Limit: There is no maximum recursion depth. An attacker can create a directory tree that is thousands of levels deep, causing the call stack to overflow.
2. Visited-Inode Tracking: The function does not track which inodes (index nodes representing files/directories) have already been visited. An attacker can craft a filesystem where a directory's inode points back to a parent or ancestor directory, creating a cycle. The recursion will never terminate, eventually exhausting the stack.

Attack Scenario:

1. An attacker creates a UFS filesystem image with a deeply nested directory structure (e.g., 10,000 levels) or an inode cycle.
2. The attacker distributes this malicious archive (e.g., via email, file sharing).
3. A victim opens the archive with a vulnerable version of NanaZip.
4. The GetAllPaths function enters infinite or extremely deep recursion.
5. The program's call stack overflows, causing a segmentation fault and crash.

Impact: Denial of service. The application becomes unavailable. No data is corrupted or stolen.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void GetAllPaths(Inode inode, string path) {
    if (inode.isDirectory()) {
        for (each child in inode.children) {
            GetAllPaths(child, path + "/" + child.name);
        }
    }
    // Add path to list
}

No depth check or visited set.

Patched Code (Conceptual):

void GetAllPaths(Inode inode, string path, int depth, set<InodeID>& visited) {
    if (depth > MAX_DEPTH) return; // Depth limit
    if (visited.count(inode.id)) return; // Cycle detection
    visited.insert(inode.id);
    
    if (inode.isDirectory()) {
        for (each child in inode.children) {
            GetAllPaths(child, path + "/" + child.name, depth + 1, visited);
        }
    }
    // Add path to list
}

Introduces a maximum depth constant and a set of visited inode IDs.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Craft a malicious UFS image to crash NanaZip.

Tools Required:

• Python 3 with struct module (or a hex editor)
• A vulnerable version of NanaZip (e.g., 5.0.1252.0)

Steps:

1. Create a Deeply Nested Directory Structure:

   • Use a script to generate a UFS image with a directory tree of 10,000 levels.
   • Each directory contains a single subdirectory, leading to a leaf file.
   • The UFS format uses inodes; each directory inode points to the next.

   import struct
   import os
   
   def create_deep_ufs_image(filename, depth=10000):
       # Simplified UFS image creation (not fully functional, for illustration)
       # In practice, use a library like pyufs or construct a raw image.
       with open(filename, 'wb') as f:
           # Write superblock, inode table, etc.
           # Create a chain of directories
           for i in range(depth):
               # Write directory inode pointing to next
               pass
       print(f"Created {filename} with depth {depth}")
   
   create_deep_ufs_image("malicious.ufs", 10000)
   

2. Create an Inode Cycle:

   • Modify the UFS image so that a directory's inode points back to its parent or itself.
   • This can be done by editing the inode's direct block pointers.

3. Deliver the Image:

   • Send the malicious UFS file to the victim via email, USB, or file sharing.

4. Trigger the Vulnerability:

   • The victim opens the file with NanaZip.
   • The application crashes immediately or after a short delay.

Expected Outcome: NanaZip process terminates with a stack overflow error.

Blue Team (Defensive)

Detection:

• Monitor for crashes of NanaZip (Event ID 1000 in Windows Application logs).
• Use file integrity monitoring to detect the presence of UFS files with unusual depth.
• Deploy the YARA rule below to scan for potentially malicious UFS images.

Prevention:

• Update NanaZip to version 6.0.1698.0 or later.
• Implement application whitelisting to prevent execution of vulnerable versions.
• Educate users not to open archives from untrusted sources.

Hunting:

• Search for UFS files in network shares or email attachments.
• Analyze crash dumps for signs of stack exhaustion.

Indicators of Compromise (IOCs)

• File Hashes (Example – not real):
  • malicious.ufs: SHA256 a1b2c3d4e5f6...
• Process Behavior:
  • NanaZip.exe crashes with exception code 0xC00000FD (stack overflow).
• Event Logs:
  • Windows Application Log: Event ID 1000, Faulting module NanaZip.exe, Exception code 0xc00000fd.
• Network: None (local vulnerability).
• Registry: None.

Detection Engineering

YARA Rule

rule CVE_2026_42445_UFS_DeepRecursion {
    meta:
        description = "Detects UFS images with potential for deep recursion (CVE-2026-42445)"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "N/A"
    strings:
        $ufs_magic = { 53 19 01 00 } // UFS1 magic (little-endian)
        $ufs2_magic = { 54 19 01 00 } // UFS2 magic
        $inode_dir = { 02 } // Directory inode type (example)
    condition:
        ($ufs_magic or $ufs2_magic) and #inode_dir > 1000
}

Sigma Rule

title: NanaZip Crash Due to UFS Stack Overflow
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects NanaZip process crashes caused by CVE-2026-42445
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Provider_Name: 'Application Error'
        Faulting_Module: 'NanaZip.exe'
        Exception_Code: '0xc00000fd'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-42445 Potential UFS Malicious Archive Transfer"; flow:to_server; content:"|53 19 01 00|"; depth:4; content:"|02|"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This rule detects UFS magic bytes in network traffic, which may indicate transfer of a malicious archive. Adjust based on environment.

Remediation & Mitigation

Immediate Actions:

1. Update NanaZip: Upgrade to version 6.0.1698.0 or later from the official GitHub repository.
2. Restrict Execution: If immediate update is not possible, block execution of vulnerable versions via application control policies.
3. User Awareness: Warn users not to open UFS files from untrusted sources.

Long-Term Measures:

• Implement input validation for archive parsers (depth limits, cycle detection).
• Conduct code reviews for recursive functions in file parsers.
• Use fuzzing tools to test archive parsers for stack exhaustion vulnerabilities.

Patch Details:

• The fix is included in NanaZip 6.0.1698.0. The patch adds a maximum recursion depth and a visited-inode set to the GetAllPaths function.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact intelligence@valters-it.com.