# CVE-2026-55780: M2Team NanaZip uncaught exception in .NET single-file handler

Source: https://junglewise.ai/threats/cve-2026-55780-m2team-nanazip-uncaught-exception-in-net-single-file-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55780 · Severity: info · CVSS 2.4 · Published 2026-07-10

NanaZip is an open-source file archiver for Windows. A vulnerability in how it handles certain .NET application bundles allows a specially crafted file to crash the application when a user attempts to extract it. This can lead to a denial-of-service where the software becomes unavailable for use until restarted, though it does not directly risk data theft.

Technologies: [M2Team NanaZip](https://junglewise.ai/threats/technologies/nanazip). Vendors: [M2Team](https://junglewise.ai/threats/vendors/m2team).

## Quick answers

**Is CVE-2026-55780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55780 being exploited in the wild.

**How severe is CVE-2026-55780?** Informational severity, with a CVSS score of 2.4, published 10 July 2026.

**Which products and versions are affected?** M2Team NanaZip < 6.5.1749.0.

**Is there a fix for CVE-2026-55780?** A patch was published on 2026-06-16: Fixed in version 6.5.1749.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55780 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-55780?** Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in NanaZip's .NET single-file bundle handler within `NanaZip.Codecs.Archive.DotNetSingleFile.cpp`. The `Extract` method sizes its extraction buffer based on the `Size` field from the bundle entry without validating it against the actual file size or bounding it to reasonable limits. Because the `Extract` function lacks a try/catch block, an attacker-controlled large size value can trigger a `std::bad_alloc` or `std::length_error` exception. This exception propagates across the COM `STDMETHODCALLTYPE` boundary, resulting in undefined behavior and a process crash. The issue is fixed in version 6.5.1749.0 by implementing proper size validation and exception handling.

## Affected products

- M2Team NanaZip < 6.5.1749.0

## Timeline

- 2026-06-16: patched: Fixed in version 6.5.1749.0
- 2026-06-16: advisory: GitHub Security Advisory GHSA-ppm9-5267-rq72 published
- 2026-07-10: disclosed: CVE-2026-55780 published to NVD

## References

- [https://github.com/M2Team/NanaZip/commit/ad62e3b4970b9f01e924c99094d6fed7a42f849a](https://github.com/M2Team/NanaZip/commit/ad62e3b4970b9f01e924c99094d6fed7a42f849a)
- [https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0](https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0)
- [https://github.com/M2Team/NanaZip/security/advisories/GHSA-ppm9-5267-rq72](https://github.com/M2Team/NanaZip/security/advisories/GHSA-ppm9-5267-rq72)

## Related threats

- [NanaZip SquashfsHandler heap out-of-bounds read and information disclosure](https://junglewise.ai/threats/cve-2026-54616-nanazip-squashfshandler-heap-out-of-bounds-read-and-information)
- [M2Team NanaZip NULL pointer dereference in NanaZip.Codecs archive handlers](https://junglewise.ai/threats/cve-2026-55783-m2team-nanazip-null-pointer-dereference-in-nanazip-codecs-archive)
- [M2Team NanaZip uncontrolled memory allocation in WebAssembly handler](https://junglewise.ai/threats/cve-2026-55782-m2team-nanazip-uncontrolled-memory-allocation-in-webassembly)
- [M2Team NanaZip memory exhaustion in UFS and FFS image handler](https://junglewise.ai/threats/cve-2026-55781-m2team-nanazip-memory-exhaustion-in-ufs-and-ffs-image-handler)
- [M2Team NanaZip heap out-of-bounds read in AVB vbmeta parser](https://junglewise.ai/threats/cve-2026-47223-m2team-nanazip-heap-out-of-bounds-read-in-avb-vbmeta-parser)