Description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4_decompress_safe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T17:18:18.090Z",
  "pubdate": "2026-08-20T17:18:18.090Z",
  "executiveSummary": "NanaZip contains an integer conversion vulnerability within the SquashFS archive parsing engine, specifically located in the Lz4Decode function.\nThe vulnerability arises from improper handling of return values from the LZ4_decompress_safe decompression routine.\nSpecifically, the function checks only for a zero return value, failing to account for negative error values returned when processing malformed input data.\nAn attacker capable of supplying a crafted SquashFS archive can exploit this flaw to cause memory corruption, leading to arbitrary heap data disclosure or application crashes.\nThe affected systems include NanaZip versions from 1.0.88.0 up to, but excluding, stable version 6.0.1698.0 and preview version 6.5.1742.0.\nExploitation requires the victim to open a maliciously crafted archive file, granting the attacker the ability to read adjacent heap memory contents through information disclosure or cause a denial of service via process termination.",
  "technicalDetails": "The vulnerability resides in the Lz4Decode function implemented within NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp.\nThe root cause is an insecure type conversion and validation failure of the return value from the LZ4_decompress_safe API.\nWhen processing compressed data blocks, LZ4_decompress_safe returns a negative integer value upon encountering malformed input or decompression errors.\nThe vulnerable implementation checks solely for a zero return value, allowing negative integers to bypass error handling.\nDuring execution, the negative integer error code is implicitly converted to an unsigned SizeT type representing the destination length (destLen).\nThis resulting large unsigned value is subsequently truncated into outBufWasWrittenSize, causing the ReadBlock function to incorrectly trust an attacker-inflated value for _cachedUnpackBlockSize.\nDuring the subsequent fragment extraction phase, an attacker-controlled inode offset can be supplied.\nThis manipulated offset forces the memcpy operation to read beyond the boundaries of the _cachedBlock heap allocation.\nConsequently, the out-of-bounds read copies adjacent heap memory contents into the extracted file, resulting in an information disclosure vulnerability.\nAlternatively, reading past valid memory allocations can trigger access violations, causing the application process to crash and leading to a denial of service condition.\nThe vulnerability affects NanaZip versions ranging from 1.0.88.0 through stable version 6.0.1698.0 (excluding the patch) and preview version 6.5.1742.0 (excluding the patch).\nAuthentication and privilege requirements are minimal, as the attack vector requires a local user to process an untrusted archive file."
}