A stack-based out-of-bounds read exists in the ZealFS bitmap parser of NanaZip. The vulnerability is triggered by opening a crafted ZealFS v1 filesystem image whose header contains an attacker‑controlled BitmapSize value; this value drives an unbounded loop that reads beyond the end of the stack‑allocated ZEALFS_V1_HEADER structure. The read can potentially expose data residing after the stack frame, leading to information disclosure, or cause a crash if the memory pattern is invalid.

M2Team’s NanaZip from version 5.0.1252.0 up to, but not including, 6.0.1698.0 is affected. Users who browse or open ZealFS v1 filesystem images with those versions are exposed.

The CVSS score of 4.4 indicates moderate baseline severity. No EPSS data is available, and the vulnerability is not listed in KEV, suggesting limited known exploitation. The likely attack vector is local file usage: an attacker must craft a ZealFS v1 image and distribute it so that a user opens it with NanaZip. Exploiting the vulnerability can reveal sensitive data from process memory but does not provide controlled code execution or persistence.