CVE-2026-42355: Nanazip: güvenlik açığı

Açıklama (NVD)

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

Özet bilgiler

Ürün

M2team Nanazip

CVSS v3.1

5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

%0,15 (yüzdelik 4)

CWE

CWE-674

Yama

Geçici çözüm

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• CWE-674