The vulnerability lies in the ROMFS archive parser of NanaZip, where circular NextOffset chains trigger an infinite loop. This behavior can consume all available CPU resources, leading to a denial of service. The flaw does not provide direct code execution or privilege escalation, so its impact is limited to service availability rather than confidentiality or integrity.

The affected product is NanaZip by M2Team. Versions from 5.0.1252.0 up to and including 6.0.1629.9 are vulnerable. The issue was fixed in version 6.0.1630.0, which is now the recommended baseline.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, which further reduces the risk assessment. The attack vector is inferred to be local or remote via a crafted ROMFS archive; an attacker would need to trigger the parser with malicious input, after which the infinite loop would degrade system availability. No publicly disclosed exploits are reported, but the low EPSS score implies limited active exploitation.