A critical denial of service vulnerability in NanaZip versions 5.0.1252.0 through 5.x allows local attackers to cause an infinite loop and crash the application.

The software contains an infinite loop vulnerability (CWE-835) within the ROMFS archive parser. An attacker with local access can trigger this by providing a specially crafted archive containing circular NextOffset chains, forcing the application into an unreachable exit condition.

The exploitation of this vulnerability results in a denial of service, rendering the NanaZip application unresponsive. While the CVSS score of 7.5 reflects a high impact on system availability, the risk is localized to the machine where the archive is processed. Frequent crashes may disrupt user workflows and hinder business operations that rely on file archival and extraction tasks.

Immediate Action: Update NanaZip to version 6.0.1630.0 or later to apply the necessary patch for the ROMFS parser.

Proactive Monitoring: Monitor system logs for repeated application crashes or unusual CPU spikes associated with the NanaZip process during file extraction operations.

Compensating Controls: Implement file scanning policies for incoming archives to ensure that only trusted files are processed, and restrict user permissions to limit the execution of untrusted software.

Public Exploit Available: Yes, a proof of concept is available via the GitHub advisory link provided by the vendor.

Given the availability of a public proof of concept and the relative ease of triggering this infinite loop, organizations should prioritize updating all instances of NanaZip to version 6.0.1630.0 immediately. Ensuring that software is kept current is the most effective way to eliminate this denial of service risk.