CVE-2026-44215

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a one-byte heap out-of-bounds null write exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS filesystem image. The attacker controls the byte offset of the write within a ~254-byte window past the heap allocation boundary. This vulnerability is fixed in 6.0.1698.0.

• CWE-787

• https://github.com/M2Team/NanaZip/security/advisories/GHSA-44wh-7gc3-w936Exploit, Mitigation, Vendor Advisory
• https://github.com/M2Team/NanaZip/security/advisories/GHSA-44wh-7gc3-w936Exploit, Mitigation, Vendor Advisory

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44209Banks generates meaningful LLM prompts using a template lang…7.5
• CVE-2026-44210Kata Containers is an open source project focusing on a stan…9.9
• CVE-2026-44211Cline is an autonomous coding agent as an SDK, IDE extension…9.6
• CVE-2026-44212PrestaShop is an open source e-commerce web application. Pri…9.3
• CVE-2026-44213The OpenTelemetry.Exporter.Instana exports telemetry to Inst…6.5
• CVE-2026-44214eventsource-encoder encodes events as well-formed EventSourc…5.3
• CVE-2026-44216Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8…7.5
• CVE-2026-44217sse-channel is an SSE-implementation which can be used to an…6.6
• CVE-2026-44218ciguard is a static security auditor for CI/CD pipelines. Fr…3
• CVE-2026-44219ciguard is a static security auditor for CI/CD pipelines. Fr…3.7
• CVE-2026-44220ciguard is a static security auditor for CI/CD pipelines. Fr…3.2
• CVE-2026-44221ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 …9