CVE-2026-27014
Stack Overflow and Infinite Loop in NanaZip ROMFS Parser
Publication date: 2026-02-19
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| m2team | nanazip | From 5.0.1252.0 (inc) to 6.0.1630.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in NanaZip, an open source file archive software. In versions starting from 5.0.1252.0 up to but not including 6.0.1630.0, the ROMFS archive parser can be exploited by specially crafted archives that contain circular NextOffset chains or deeply nested directories.
The circular NextOffset chains cause the parser to enter an infinite loop, while deeply nested directories cause unbounded recursion, leading to a stack overflow. Both conditions can disrupt normal operation of the software.
This issue was fixed in version 6.0.1630.0.
How can this vulnerability impact me? :
Exploitation of this vulnerability can cause NanaZip to become unresponsive or crash due to infinite loops or stack overflows when processing maliciously crafted archives.
This can lead to denial of service conditions, potentially interrupting workflows that rely on NanaZip for archive extraction or management.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update NanaZip to version 6.0.1630.0 or later, as this version patches the issue with circular NextOffset chains and deeply nested directories causing infinite loops and stack overflows.