Quick answers
- Is CVE-2026-55780 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55780 being exploited in the wild.
- How severe is CVE-2026-55780?
- Informational severity, with a CVSS score of 2.4, published 10 July 2026.
- Which products and versions are affected?
- M2Team NanaZip < 6.5.1749.0.
- Is there a fix for CVE-2026-55780?
- A patch was published on 2026-06-16: Fixed in version 6.5.1749.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55780 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-55780?
- Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in NanaZip's .NET single-file bundle handler within `NanaZip.Codecs.Archive.DotNetSingleFile.cpp`. The `Extract` method sizes its extraction buffer based on the `Size` field from the bundle entry without validating it against the actual file size or bounding it to reasonable limits. Because the `Extract` function lacks a try/catch block, an attacker-controlled large size value can trigger a `std::bad_alloc` or `std::length_error` exception. This exception propagates across the COM `STDMETHODCALLTYPE` boundary, resulting in undefined behavior and a process crash. The issue is fixed in version 6.5.1749.0 by implementing proper size validation and exception handling.
Affected products
- M2Team NanaZip < 6.5.1749.0
Timeline
- 2026-06-16: patched: Fixed in version 6.5.1749.0
- 2026-06-16: advisory: GitHub Security Advisory GHSA-ppm9-5267-rq72 published
- 2026-07-10: disclosed: CVE-2026-55780 published to NVD