CVE-2026-42355

{
  "id": "CVE-2026-42355",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T20:16:41.260",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser in NanaZip. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0."
    },
    {
      "lang": "es",
      "value": "NanaZip es un archivador de archivos de código abierto. Desde 5.0.1252.0 hasta antes de 6.0.1698.0, existe una vulnerabilidad de recursión incontrolada en el analizador de Electron Archive (ASAR) en NanaZip. Al abrir un archivo .asar manipulado con JSON profundamente anidado en la cabecera, tanto nlohmann::json::parse como la función GetAllPaths del gestor recurren sin límites de profundidad, agotando la pila del hilo y provocando el fallo del proceso de NanaZip. Esta vulnerabilidad está corregida en 6.0.1698.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "M2Team",
          "product": "NanaZip",
          "versions": [
            {
              "version": ">= 5.0.1250.0, < 6.0.1698.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T14:56:28.526169Z",
          "id": "CVE-2026-42355",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.1250.0",
              "versionEndExcluding": "6.0.1698.0",
              "matchCriteriaId": "6DA72AE3-0544-433D-9DF5-7FC8DFDDF3C2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-4gxf-p4q6-gfrf",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}