Uncontrolled recursion in the Electron ASAR parser allows a crafted archive file to exhaust the thread stack, crashing NanaZip. The flaw is caused by the parser lacking depth limits when handling nested JSON within the archive header, leading to stack exhaustion during parsing of maliciously crafted .asar files. This results in a local denial of service, as the application terminates unexpectedly.

The vulnerability affects NanaZip versions from 5.0.1252.0 up to but not including 6.0.1698.0. All installations of this open‑source archival tool from M2Team that have not applied the patch to 6.0.1698.0 or later are susceptible.

The CVSS score of 3.3 denotes a moderate impact. Exploitation requires the attacker to supply a specially crafted .asar file and convince a user to open it, so the attack vector is inferred to be local. The EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog. Nonetheless, any privileged user who can force NanaZip to open a malicious archive can cause a denial of service on that system.