Executive brief
NanaZip is an open-source file archiver for Windows. A vulnerability in how it handles certain .NET application bundles allows a specially crafted file to crash the application when a user attempts to extract it. This can lead to a denial-of-service where the software becomes unavailable for use until restarted, though it does not directly risk data theft.
Technical details
A vulnerability exists in NanaZip's .NET single-file bundle handler within `NanaZip.Codecs.Archive.DotNetSingleFile.cpp`. The `Extract` method sizes its extraction buffer based on the `Size` field from the bundle entry without validating it against the actual file size or bounding it to reasonable limits. Because the `Extract` function lacks a try/catch block, an attacker-controlled large size value can trigger a `std::bad_alloc` or `std::length_error` exception. This exception propagates across the COM `STDMETHODCALLTYPE` boundary, resulting in undefined behavior and a process crash. The issue is fixed in version 6.5.1749.0 by implementing proper size validation and exception handling.
Affected products
- M2Team NanaZip < 6.5.1749.0
Timeline
- 2026-06-16: patched: Fixed in version 6.5.1749.0
- 2026-06-16: advisory: GitHub Security Advisory GHSA-ppm9-5267-rq72 published
- 2026-07-10: disclosed: CVE-2026-55780 published to NVD