The vulnerability lies in NanaZip’s littlefs filesystem image parser, where the Open method blindly reads an attacker‑controlled BlockCount from the archive’s superblock and then creates one heap allocation per count. A crafted archive with a BlockCount of 0xFFFFFFFF forces approximately four billion heap allocations, exhausting system memory and causing a service stall or crash. The weakness is a classic example of unbounded resource consumption (CWE‑770).

The flaw affects users of M2Team’s NanaZip file archiver. Versions from 5.0.1252.0 up to, but not including, 6.0.1698.0 are vulnerable. Later releases contain a fix that validates the BlockCount value against the actual file size and an upper bound.

The published CVSS score of 3.3 indicates a low severity rating, consistent with a denial‑of‑service impact that requires the ability to supply a malicious archive to the application. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that no widespread exploits are documented. The attack vector is inferred to be local or semi‑remote, relying on the user or an attacker with access to send a crafted littlefs image to the NanaZip parser. Successful exploitation would consume all available memory used by the process, potentially crashing the application or the host system.