In NanaZip versions 5.0.1252.0 through 6.0.1629.999, the .NET Single File bundle header parser performs a missing bounds check, allowing an attacker to trigger an out-of-bounds heap read when a crafted archive is opened. The result is either a program crash or the leakage of sensitive heap data to the user, which may expose confidential information but does not directly allow code execution. The vulnerability is classified under CWE-125 and CWE-126 and carries a CVSS score of 5.2, indicating a moderate severity.

The issue affects the M2Team NanaZip open‑source file archive application. Affected releases include all builds starting at version 5.0.1252.0 and up to, but not including, 6.0.1630.0. The patch is available in NanaZip 6.0.1630.0 and newer. Users of earlier versions are vulnerable.

The CVSS score of 5.2 reflects a moderate impact, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild. NanaZip does not appear in the CISA KEV catalog. Because the flaw is triggered by opening a crafted archive file, the attack vector is inferred to be local or user‑initiated; no network‑based exploitation is described. An attacker who can supply a malicious file to a target user can cause a denial‑of‑service or information‑leak event, but cannot gain arbitrary code execution or remote foothold.