CVE-2026-26282

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap read in `.NET Single File` bundle header parser due to missing bounds check. Opening a crafted file with NanaZip causes a crash or leaks heap data to the user. Version 6.0.1630.0 patches the issue.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-126 CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-262837.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `CVE-2026-262849.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Ima CVE-2026-262868.5SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-262877.1External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting CVE-2026-262889.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate d CVE-2026-262898.2PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive inf CVE-2026-26297.3A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise CVE-2026-262909.8The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-262914.8Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be CVE-2026-262929.8Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migra CVE-2026-26308.8A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where CVE-2026-263044.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members