PT-2026-20927 · Nanazip · Nanazip

Mourinaruto · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2026-26282

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanaZip versions 5.0.1252.0 through 6.0.1629.9

Description NanaZip, an open source file archive, contains an out-of-bounds heap read in the .NET Single File bundle header parser due to a missing bounds check. Opening a specially crafted file with NanaZip can lead to a crash or the leakage of heap data to the user.

Recommendations Update to NanaZip version 6.0.1630.0 or later.

Exploit

Correção

Out of bounds Read

Buffer Over-read

Enumeração de Fraquezas

CWE-125

CWE-126

Identificadores relacionados

CVE-2026-26282

GHSA-CCPC-2222-XV5C

Produtos afetados

Nanazip

Referências · 6

• 🔥 https://github.com/M2Team/NanaZip/security/advisories/GHSA-ccpc-2222-xv5c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26282.json · Exploit
• 🔥❌ https://github.com/user-attachments/files/25274143/poc.exe.zip · Exploit, Deleted
• https://t.me/CVEtracker/45175 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-26282 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26282 · Aviso do Fabricante