NanaZip's UFS/UFS2 parser contains an uncontrolled recursion flaw where the GetAllPaths function dives into subdirectories without any depth limit or cycle detection. A specially crafted UFS image that contains a deep nested directory tree or an inode loop can exhaust the call stack, causing the NanaZip process to crash. The immediate consequence is a denial of service to the local user or any service that depends on NanaZip, with no elevation of privilege or data disclosure.

The vulnerability affects the M2Team NanaZip application, specifically versions that start at 5.0.1252.0 and continue through any release before 6.0.1698.0. Versions 6.0.1698.0 and later contain the fix.

The CVSS score of 3.3 reflects a low-severity denial of service risk. EPSS is not available, and the issue is not listed in CISA KEV catalogs, indicating limited public exploitation activity. The likely attack vector requires an adversary to deliver a malicious UFS image to NanaZip, either by providing it to a local user or by exploiting a path where user-supplied archives are processed. Because the flaw does not involve remote code execution or privilege escalation, it is considered an isolated local or sandboxed denial of service vector.