NanaZip uses a UFS parser to process .ufs/.ufs2/.img files. In versions 5.0.1252.0 through earlier 6.x releases, a defect in the parser lifts a directory record length without validation. When opening a crafted archive, the parser reads or writes beyond the intended bounds. The resulting memory corruption can cause the application to crash or hang, and the nature of heap corruption suggests that a malicious actor could potentially achieve arbitrary code execution if the vulnerability is reliably exploitable. This type of flaw is classified as an out-of-bounds memory access (CWE-125).

This flaw affects NanaZip applications distributed by M2Team. Specifically, all releases starting at version 5.0.1252.0 up to, but not including, 6.0.1638.0 and 6.5.1638.0 are vulnerable.

The CVSS v3.1 base score is 5.1, indicating a medium severity. The Exploit Prediction Scoring System assigns the exploit probability to less than 1 %, implying that, even if the vulnerability is known, successful exploitation is unlikely at this time. The issue is not listed in the CISA KEV catalog. Because the exploit requires a crafted archive file to be opened by a user, the attack vector can be inferred as local; an attacker would need to deliver or persuade a local user to open the malicious file. If exploited, consequences include application crash, potential denial of service, and, in the worst case, arbitrary code execution due to heap corruption.