CVE-2026-54616

Name of the Vulnerable Software and Affected Versions NanaZip versions 1.0.88.0 through 6.0.1697.0 NanaZip versions 1.0.88.0 through 6.5.1741.0

Description The Lz4Decode() function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp incorrectly handles return values from LZ4 decompress safe(). It only rejects a zero return, while malformed input can produce a negative error value. This negative integer is converted to an unsigned destLen and truncated into outBufWasWrittenSize, leading the ReadBlock() function to trust an inflated cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can cause memcpy() to read beyond the cachedBlock heap allocation, potentially leaking adjacent heap contents into the extracted file or causing the process to crash.

Recommendations Update to stable version 6.0.1698.0. Update to preview version 6.5.1742.0.