PT-2026-20927 · Nanazip · Nanazip

Mourinaruto · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-26282

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanaZip versions 5.0.1252.0 through 6.0.1629.9

Description NanaZip, an open source file archive, contains an out-of-bounds heap read in the .NET Single File bundle header parser due to a missing bounds check. Opening a specially crafted file with NanaZip can lead to a crash or the leakage of heap data to the user.

Recommendations Update to NanaZip version 6.0.1630.0 or later.

Exploit

Fix

Out of bounds Read

Buffer Over-read

Weakness Enumeration

CWE-125

CWE-126

Related Identifiers

CVE-2026-26282

GHSA-CCPC-2222-XV5C

Affected Products

Nanazip

References · 6

• 🔥 https://github.com/M2Team/NanaZip/security/advisories/GHSA-ccpc-2222-xv5c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26282.json · Exploit
• 🔥❌ https://github.com/user-attachments/files/25274143/poc.exe.zip · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-26282 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26282 · Vendor Advisory
• https://t.me/CVEtracker/45175 · Telegram Post