The vulnerability resides in the Lz4Decode routine used by NanaZip to decompress SquashFS archives. A negative return value from the underlying LZ4_decompress_safe function is incorrectly treated as success, which results in an out-of-bounds read when the function later uses the inflated size to copy data into heap memory. This flaw matches CWE-125 and allows an attacker to read adjacent heap contents or crash the process during fragment extraction.

All Windows installations of NanaZip prior to version 6.0.1698.0 are affected. Preview 6.5.1742.0 remains fixed and is not vulnerable.

The CVSS score of 7.1 indicates high severity, while the EPSS score is not available, so the precise likelihood of exploitation is unknown. The vulnerability has not been listed in CISA’s KEV catalog. An attacker would need to supply a malformed SquashFS archive to NanaZip’s extraction routine. Based on the description, it is inferred that such an operation could occur in a local context where the user processes an untrusted file, or in a remote context if the application accepts archives from external sources. A successful exploitation leads either to information disclosure from the heap or to denial of service through a crash.