NanaZip, an open‑source archiving tool, contains a null‑pointer dereference in its UFS/UFS2 filesystem image parser. When the parser opens a UFS image whose root inode is incorrectly configured as a symlink, the code assumes it is a directory, allocates a zero‑length buffer, and then dereferences a null pointer during the first read. The result is a crash of the NanaZip process, which can lead to a denied‑service condition for users attempting to extract the archive.

The vulnerability affects M2Team’s NanaZip from versions 5.0.1252.0 up through, but not including, 6.0.1698.0. Any installation of NanaZip within this range that is used to open untrusted UFS images is impacted.

The CVSS score of 3.3 indicates low severity; the vulnerability is not listed in CISA’s KEV catalog and no EPSS value is available. Exploitation requires an attacker to supply a specially crafted UFS image to the vulnerable version of NanaZip, typically achievable when the application is run locally or a user opens a malicious archive. Because the defect causes a crash rather than privilege escalation or data disclosure, the risk is primarily a local denial of service. Updating to version 6.0.1698.0 or newer resolves the issue.