CVE-2026-27709
NanaZip is an open source file archive.
Published Feb 26, 2026 · updated Jun 17, 2026 · m2team nanazip
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed so the parser constructs a from memory beyond , leading to crash and potential in-process memory disclosure. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 26, 2026 · NIST NVD
Detected
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed so the parser constructs a from memory beyond , leading to crash and potential in-process memory disclosure. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
Jun 17, 2026 · NIST NVD
Updated
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed so the parser constructs a from memory beyond , leading to crash and potential in-process memory disclosure. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
Affected
- cpe m2team/nanazipversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-27709
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, NanaZip’s parser has an out-of-bounds read vulnerability in manifest parsing. A crafted bundle can provide a malformed `RelativeP
nvd.nist.gov