CVE-2026-27014CWE-674

NanZip has ROMFS Archive Infinite Loop / Stack Overflow

Medium · published February 19, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and deeply nested directories cause unbounded recursion (stack overflow) in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00169 · 5.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-02-19T20:45Z
EPSS history
Timeline
  • 19 FEB 20:45Z
    NanZip has ROMFS Archive Infinite Loop / Stack Overflow
    cvelistv5