NanaZip, an open‑source file archive, has an integer divide‑by‑zero error in its UFS/UFS2 filesystem image parser. An attacker can craft a UFS image with the superblock field fs_ipg (inodes per cylinder group) set to zero. The parser uses this value as a divisor without validation, resulting in a hardware trap that crashes the process. This flaw is a classic division‑by‑zero vulnerability (CWE‑369) and yields only a crash – no privilege escalation or code execution.

The flaw exists in NanaZip versions 5.0.1252.0 through 6.0.1697.999 (any release prior to 6.0.1698.0). All builds of the product from the specified starting point up to the fix are affected.

The CVSS score of 3.3 indicates a low impact assessment. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The attack requires local supply of a malicious UFS image, so the impact is limited to denial of service for whoever opens the file. Exploitation is straightforward – providing the crafted file causes an immediate crash – but the lack of remote or privilege‑elevating capabilities reduces overall risk for most production environments.