CVE-2026-54616
Received Received - Intake

Heap Buffer Overflow in NanaZip LZ4 Decompression

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-54616
EUVD
EUVD-2026-63481

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
nanazip nanazip to 6.5.1742.0 (inc)
m2team nanazip 1.0.88.0
m2team nanazip 6.0.1698.0
m2team nanazip 6.5.1742.0
m2team nanazip From 1.0.88.0|end_including=6.0.1698.0 (inc)
m2team nanazip From 6.0.1698.0|end_including=6.5.1742.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression wrapper. It occurs because the Lz4Decode function only checks for a zero return value from LZ4_decompress_safe, but negative error values are not rejected. When a negative value is converted to an unsigned SizeT, it becomes a very large positive number, causing memcpy to read beyond the allocated heap buffer during fragment extraction. This allows attackers to leak heap contents into extracted files or crash the process.

Detection Guidance

This vulnerability is specific to NanaZip's SquashFS LZ4 decompression and requires examining NanaZip versions or SquashFS file handling. Check NanaZip version with 'nana-zip --version' or inspect installed files. Monitor for crashes during SquashFS extraction or unusual file contents. No direct network detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to read sensitive data from memory that is adjacent to the heap buffer used for decompression. This could lead to information disclosure, where heap contents are leaked into extracted files. Additionally, the process may crash due to the out-of-bounds read, causing a denial-of-service condition.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling information disclosure through heap memory leaks during file extraction. Attackers could extract sensitive data from memory into files, violating confidentiality requirements under these regulations.

Mitigation Strategies
  • Update NanaZip to stable version 6.0.1698.0 or later, or preview version 6.5.1742.0 or later.
  • Avoid extracting files from untrusted SquashFS images with LZ4 compression until updated.
  • Monitor NanaZip releases for further updates addressing inherited 7-Zip vulnerabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart