CVE-2026-54616

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54616
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54616.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54616
Aliases
  • GHSA-95x5-qvvm-hmfp
Published
2026-08-20T16:11:54.192Z
Modified
2026-08-22T09:15:53.624002Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L CVSS Calculator
Summary
NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value
Details

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4decompresssafe even though malformed input produces a negative error value. The negative int is converted to the unsigned SizeT destLen and then truncated into outBufWasWrittenSize, causing ReadBlock to trust an attacker-inflated _cachedUnpackBlockSize. During fragment extraction, an attacker-controlled inode Offset can make memcpy read beyond the _cachedBlock heap allocation and place adjacent heap contents in the extracted file, or crash the process. This issue is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0.

Database specific 
{
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54616.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/m2team/nanazip

Affected ranges

Type
GIT
Repo
https://github.com/m2team/nanazip
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
eeb2aea2642e57ceb55c1b7fe287078cfc61730d
Fixed
28b2bc47eaa37f56c670c72401d97fb1178e87b8
Fixed
3d7eabe2de2c49a3080f7063fa1d25d4ceb9e903
Fixed
733e8570d2ba96c3e52aab44f5fd886775d5952f
Fixed
ce0322a1932e16a53e4a13e48bc61804c7826956
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.0.88.0"
        },
        {
            "fixed": "6.0.1698.0"
        },
        {
            "introduced": "6.5.1638.0"
        },
        {
            "fixed": "6.5.1742.0"
        }
    ]
}

Affected versions

1.*
1.0
1.0-Preview1
1.0-Preview2
1.0-Preview3
1.0-Preview4
1.1
1.1+ServicingUpdate1-Preview1
1.1+ServicingUpdate1-Preview2
1.1+ServicingUpdate1-Preview3
1.1-Preview1
1.1-Preview2
1.1-Preview2-Update1
1.2
1.2-Preview4
1.2.253
2.*
2.0.313
2.0.376
2.0.396
2.0.450
2.1.451
3.*
3.0.1000.0
3.0.756
3.0.996
3.1.1080.0
3.5.1000.0
3.5.996
5.*
5.0.1188.0
5.0.1215.0
5.0.1243.0
5.0.1250.0
5.0.1252.0
5.0.1263.0
5.1.1252.0
5.1.1263.0
6.*
6.0.1461.0
6.0.1621.0
6.0.1630.0
6.0.1632.0
6.0.1638.0
6.0.1650.0
6.0.1691.0
6.5.1638.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54616.json"
vanir_signatures 
[
    {
        "id": "CVE-2026-54616-1f2702ff",
        "source": "https://github.com/m2team/nanazip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956",
        "signature_type": "Function",
        "target": {
            "function": "Lz4Decode",
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "98602920034055399985769816035855691399",
            "length": 353.0
        }
    },
    {
        "id": "CVE-2026-54616-3010027c",
        "source": "https://github.com/m2team/nanazip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956",
        "signature_type": "Function",
        "target": {
            "function": "CHandler::Open2",
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/LvmHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "175623277639264502320703514189232884016",
            "length": 4476.0
        }
    },
    {
        "id": "CVE-2026-54616-7c712196",
        "source": "https://github.com/m2team/nanazip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956",
        "signature_type": "Line",
        "target": {
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/AvbHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "120441109771884193898496886484788133066",
                "308819737052960197109134306766539585055",
                "256842079255596672597091945697003462526",
                "249303949066035680149976447162930678535",
                "110920293150411927697095760123040951394",
                "185130735788726869307151718479797789364",
                "317338004563132327894389442739073996259",
                "26200440494228530409765842836565389990",
                "235447551997747536038356656757314299878",
                "117160667682353307577940685473445228127",
                "64677872449043714927532322895679387601",
                "155600274750083725341287743552828516839",
                "230862888711360257930121560994244622623",
                "214676146634207380412441319127218772623",
                "23098794406163762610212073007577285051",
                "319456943400048003699916404501440691983",
                "184652171868659664165018443755191498926",
                "83177461943065505829206456379062158422",
                "258090880066570319559429604936778672030",
                "186665875420040982862235814831291187685",
                "72292320675607719278587257680509090872"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2026-54616-7f8e88c3",
        "source": "https://github.com/m2team/nanazip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f",
        "signature_type": "Function",
        "target": {
            "function": "CHandler::Open2",
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/AvbHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "238376645228592762974751053772823121100",
            "length": 3092.0
        }
    },
    {
        "id": "CVE-2026-54616-8a61d9d4",
        "source": "https://github.com/m2team/nanazip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f",
        "signature_type": "Line",
        "target": {
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "10280318609078537118512216064204027992",
                "42573920001125835908459630733111523417",
                "17303700639590514770677730870204365987",
                "102967627588282001582633599734810098296",
                "26128171273762047362719009195123565434",
                "44282240735180211492713224969416775161",
                "45959571829741060856557862941191050229"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2026-54616-8cd93438",
        "source": "https://github.com/m2team/nanazip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f",
        "signature_type": "Line",
        "target": {
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/AvbHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "120441109771884193898496886484788133066",
                "308819737052960197109134306766539585055",
                "256842079255596672597091945697003462526",
                "249303949066035680149976447162930678535",
                "110920293150411927697095760123040951394",
                "185130735788726869307151718479797789364",
                "317338004563132327894389442739073996259",
                "26200440494228530409765842836565389990",
                "235447551997747536038356656757314299878",
                "117160667682353307577940685473445228127",
                "64677872449043714927532322895679387601",
                "155600274750083725341287743552828516839",
                "230862888711360257930121560994244622623",
                "214676146634207380412441319127218772623",
                "23098794406163762610212073007577285051",
                "319456943400048003699916404501440691983",
                "184652171868659664165018443755191498926",
                "83177461943065505829206456379062158422",
                "258090880066570319559429604936778672030",
                "186665875420040982862235814831291187685",
                "72292320675607719278587257680509090872"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2026-54616-94d8c1fc",
        "source": "https://github.com/m2team/nanazip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f",
        "signature_type": "Function",
        "target": {
            "function": "CHandler::Open2",
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/LvmHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "175623277639264502320703514189232884016",
            "length": 4476.0
        }
    },
    {
        "id": "CVE-2026-54616-aba9abe9",
        "source": "https://github.com/m2team/nanazip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956",
        "signature_type": "Function",
        "target": {
            "function": "CHandler::Open2",
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/AvbHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "238376645228592762974751053772823121100",
            "length": 3092.0
        }
    },
    {
        "id": "CVE-2026-54616-b5381703",
        "source": "https://github.com/m2team/nanazip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f",
        "signature_type": "Function",
        "target": {
            "function": "Lz4Decode",
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "98602920034055399985769816035855691399",
            "length": 353.0
        }
    },
    {
        "id": "CVE-2026-54616-bc340098",
        "source": "https://github.com/m2team/nanazip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956",
        "signature_type": "Line",
        "target": {
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "10280318609078537118512216064204027992",
                "42573920001125835908459630733111523417",
                "17303700639590514770677730870204365987",
                "102967627588282001582633599734810098296",
                "26128171273762047362719009195123565434",
                "44282240735180211492713224969416775161",
                "45959571829741060856557862941191050229"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2026-54616-f22e653c",
        "source": "https://github.com/m2team/nanazip/commit/733e8570d2ba96c3e52aab44f5fd886775d5952f",
        "signature_type": "Line",
        "target": {
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/LvmHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145931525184268917301715623340879148388",
                "296639399686090619948473820123359407990",
                "214782655763031717763803941618205817059",
                "250068775152928811352886121313522629779"
            ],
            "threshold": 0.9
        }
    },
    {
        "id": "CVE-2026-54616-f99f46cf",
        "source": "https://github.com/m2team/nanazip/commit/ce0322a1932e16a53e4a13e48bc61804c7826956",
        "signature_type": "Line",
        "target": {
            "file": "NanaZip.Core/SevenZip/CPP/7zip/Archive/LvmHandler.cpp"
        },
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145931525184268917301715623340879148388",
                "296639399686090619948473820123359407990",
                "214782655763031717763803941618205817059",
                "250068775152928811352886121313522629779"
            ],
            "threshold": 0.9
        }
    }
]
vanir_signatures_modified 
"2026-08-22T09:15:53Z"