CVE-2026-42446

Executive Summary

CVE-2026-42446 is a stack-based out-of-bounds read vulnerability in NanaZip, an open-source file archiver. The flaw resides in the ZealFS filesystem image parser, specifically when processing a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the file header drives an unbounded loop that reads past the end of a stack-allocated ZEALFS_V1_HEADER structure. This can lead to a denial of service (DoS) condition due to memory corruption or application crash. The vulnerability affects versions from 5.0.1252.0 to before 6.0.1698.0 and has been patched in version 6.0.1698.0. The CVSS score is 4.4 (Medium), with a local attack vector and low complexity. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

NanaZip is distributed as a standalone application and via package managers like Chocolatey and Winget. Users should verify the integrity of downloaded packages using checksums provided by the official repository. The vulnerability does not directly affect package dependencies but impacts the application’s core parsing logic.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Attack Vector: Local (AV:L) – requires the victim to open a malicious file.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: Required (UI:R) – victim must open the crafted file.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – can cause application crash or denial of service.

Threat Level: Medium. The vulnerability requires user interaction and local access, but can be triggered by simply opening a malicious archive, making it a viable vector for phishing or social engineering attacks.

Deep Dive & Mechanics

The vulnerability exists in the ZealFS filesystem image parser within NanaZip. ZealFS is a custom filesystem format used for storing compressed archives. The parser reads a file header structure (ZEALFS_V1_HEADER) from the stack. This header contains a BitmapSize field that specifies the size of a bitmap used for file allocation. The parser then uses this value to iterate over bitmap entries in a loop. However, there is no bounds checking on the BitmapSize field. An attacker can set BitmapSize to an arbitrarily large value, causing the loop to read beyond the allocated stack buffer, leading to an out-of-bounds read. This can corrupt memory or cause the application to crash.

The root cause is a missing validation of the BitmapSize field against the actual size of the stack-allocated header. The fix in version 6.0.1698.0 adds a check to ensure BitmapSize does not exceed the header size.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

typedef struct {
    uint32_t Magic;
    uint32_t BitmapSize;
    // ... other fields
} ZEALFS_V1_HEADER;

void ParseZealFS(ZEALFS_V1_HEADER header) {
    // No bounds check on header.BitmapSize
    for (uint32_t i = 0; i < header.BitmapSize; i++) {
        // Read from stack buffer beyond header
        uint8_t bit = header.Bitmap[i]; // Out-of-bounds read
    }
}

Patched Code (simplified):

void ParseZealFS(ZEALFS_V1_HEADER header) {
    // Validate BitmapSize against actual header size
    if (header.BitmapSize > sizeof(header.Bitmap)) {
        // Handle error
        return;
    }
    for (uint32_t i = 0; i < header.BitmapSize; i++) {
        uint8_t bit = header.Bitmap[i];
    }
}

The patch adds a check to ensure BitmapSize does not exceed the size of the Bitmap array within the header structure.

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial of service by crafting a malicious ZealFS v1 filesystem image.

Steps:

1. Create a valid ZealFS v1 header with a crafted BitmapSize field set to a large value (e.g., 0xFFFFFFFF).
2. Embed this header into a NanaZip archive file.
3. Deliver the file to the victim via email or download.
4. When the victim opens the file with NanaZip, the parser will read out-of-bounds, causing a crash.

Example Crafted Header (hex):

4D 5A 00 00 FF FF FF FF 00 00 00 00 00 00 00 00

• 4D 5A = Magic bytes (example)
• FF FF FF FF = BitmapSize (large value)

Note: No public exploit code is available. This is a theoretical approach.

Blue Team

Detection:

• Monitor for crashes of NanaZip.exe with unusual stack traces.
• Use file integrity monitoring to detect modified NanaZip binaries.
• Deploy endpoint detection and response (EDR) rules for out-of-bounds read patterns.

Prevention:

• Block execution of NanaZip versions < 6.0.1698.0.
• Use application whitelisting to allow only patched versions.
• Educate users not to open untrusted archive files.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • Malicious archive: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Name: NanaZip.exe
• Registry Keys: None
• Network Indicators: None (local vulnerability)
• Behavioral: Application crash with access violation reading address 0xXXXXXXXX.

Detection Engineering

YARA Rule

rule CVE_2026_42446_ZealFS_OOB_Read {
    meta:
        description = "Detects crafted ZealFS v1 headers with oversized BitmapSize"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-42446"
    strings:
        $magic = { 5A 46 53 01 } // ZealFS v1 magic bytes (example)
        $bitmap_size = { FF FF FF FF } // Large BitmapSize
    condition:
        $magic at 0 and $bitmap_size at 4
}

Sigma Rule

title: CVE-2026-42446 - NanaZip ZealFS Out-of-Bounds Read
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects NanaZip crashes due to crafted ZealFS v1 images
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\NanaZip.exe'
        CommandLine|contains: '*.zip'  # Adjust based on file extension
    condition: selection
falsepositives:
    - Legitimate large archives
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-42446 - NanaZip ZealFS OOB Read Attempt"; flow:to_server; content:"|5A 46 53 01|"; offset:0; depth:4; content:"|FF FF FF FF|"; offset:4; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update NanaZip to version 6.0.1698.0 or later.
2. Workaround: If unable to update, avoid opening untrusted archive files with NanaZip.
3. Detection: Deploy the provided YARA and Sigma rules to detect malicious files and crashes.
4. Monitoring: Monitor for unusual crashes of NanaZip.exe and investigate associated files.
5. User Training: Educate users on the risks of opening archives from untrusted sources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert