PT-2026-20928 · Nanazip · Nanazip

Mourinaruto · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-27014

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanaZip versions 5.0.1252.0 through 6.0.1629.9

Description NanaZip, an open source file archive, is affected by an issue where circular NextOffset chains can cause an infinite loop, and deeply nested directories can lead to unbounded recursion, resulting in a stack overflow within the ROMFS archive parser.

Recommendations Update to version 6.0.1630.0 or later.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-27014

GHSA-FC89-3F57-H9Q5

Affected Products

Nanazip

References · 5

• 🔥 https://github.com/M2Team/NanaZip/security/advisories/GHSA-fc89-3f57-h9q5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27014.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-27014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27014 · Security Note
• https://t.me/CVEtracker/45179 · Telegram Post