Vulnerability-Lookup

CVE-2026-54616 (GCVE-0-2026-54616)

Vulnerability from cvelistv5 – Published: 2026-08-20 16:11 – Updated: 2026-08-20 19:52

Title

NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value

Summary

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 19:52 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/M2Team/NanaZip/security/adviso…	x_refsource_CONFIRM
https://github.com/M2Team/NanaZip/commit/733e8570…	x_refsource_MISC
https://github.com/M2Team/NanaZip/commit/ce0322a1…	x_refsource_MISC
https://github.com/M2Team/NanaZip/releases/tag/6.…	x_refsource_MISC
https://github.com/M2Team/NanaZip/releases/tag/6.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
M2Team	NanaZip	Affected: >= 1.0.88.0, < 6.0.1698.0 Affected: >= 6.5.1638.0, < 6.5.1742.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54616",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T19:52:01.141088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T19:52:07.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NanaZip",
          "vendor": "M2Team",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.88.0, \u003c 6.0.1698.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.5.1638.0, \u003c 6.5.1742.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T16:11:54.192Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp"
        },
        {
          "name": "https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f"
        },
        {
          "name": "https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956"
        },
        {
          "name": "https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0"
        },
        {
          "name": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0"
        }
      ],
      "source": {
        "advisory": "GHSA-95x5-qvvm-hmfp",
        "discovery": "UNKNOWN"
      },
      "title": "NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54616",
    "datePublished": "2026-08-20T16:11:54.192Z",
    "dateReserved": "2026-06-15T20:07:02.184Z",
    "dateUpdated": "2026-08-20T19:52:07.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54616",
      "date": "2026-08-26",
      "epss": "0.00319",
      "percentile": "0.24233"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54616\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-20T17:18:18.090\",\"lastModified\":\"2026-08-20T20:17:34.867\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"M2Team\",\"product\":\"NanaZip\",\"versions\":[{\"version\":\"\u003e= 1.0.88.0, \u003c 6.0.1698.0\",\"status\":\"affected\"},{\"version\":\"\u003e= 6.5.1638.0, \u003c 6.5.1742.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-20T19:52:01.141088Z\",\"id\":\"CVE-2026-54616\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"references\":[{\"url\":\"https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54616\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-20T19:52:01.141088Z\"}}}], \"references\": [{\"url\": \"https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T19:51:38.949Z\"}}], \"cna\": {\"title\": \"NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value\", \"source\": {\"advisory\": \"GHSA-95x5-qvvm-hmfp\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"M2Team\", \"product\": \"NanaZip\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.0.88.0, \u003c 6.0.1698.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.5.1638.0, \u003c 6.5.1742.0\"}]}], \"references\": [{\"url\": \"https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp\", \"name\": \"https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f\", \"name\": \"https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956\", \"name\": \"https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0\", \"name\": \"https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0\", \"name\": \"https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125: Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-20T16:11:54.192Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54616\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T19:52:07.850Z\", \"dateReserved\": \"2026-06-15T20:07:02.184Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-20T16:11:54.192Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54616

Vulnerability from fkie_nvd - Published: 2026-08-20 17:18 - Updated: 2026-08-20 20:17

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f
	security-advisories@github.com	https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956
	security-advisories@github.com	https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0
	security-advisories@github.com	https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0
	security-advisories@github.com	https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "NanaZip",
          "vendor": "M2Team",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.88.0, \u003c 6.0.1698.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.5.1638.0, \u003c 6.5.1742.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0."
    }
  ],
  "id": "CVE-2026-54616",
  "lastModified": "2026-08-20T20:17:34.867",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54616",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-20T19:52:01.141088Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T17:18:18.090",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/M2Team/NanaZip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/M2Team/NanaZip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/M2Team/NanaZip/releases/tag/6.0.1698.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1742.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-95x5-qvvm-hmfp"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-54616 (GCVE-0-2026-54616)

FKIE_CVE-2026-54616

Tags

Sightings

Nomenclature