Quick answers
- Is CVE-2026-55781 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55781 being exploited in the wild.
- How severe is CVE-2026-55781?
- Informational severity, with a CVSS score of 2.4, published 10 July 2026.
- Which products and versions are affected?
- M2Team NanaZip < 6.5.1749.0.
- Is there a fix for CVE-2026-55781?
- A patch was published on 2026-06-16: Fixed in version 6.5.1749.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55781 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-55781?
- Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in NanaZip's UFS and FFS image handler within `NanaZip.Codecs.Archive.Ufs.cpp`. The parser validates the superblock block size (`fs_bsize`) only against a minimum bound and fails to validate the fragment size (`fs_fsize`). An attacker can provide a crafted UFS image with large 32-bit values in these fields, which are subsequently used as sizes for indirect-block, directory, and extraction buffer allocations. This results in uncontrolled resource consumption (CWE-400/CWE-789), allowing a small image to trigger multi-gigabyte allocations that cause `std::bad_alloc` exceptions or system memory exhaustion. The issue is fixed in version 6.5.1749.0 by implementing proper upper-bound checks and validating fragment sizes against the block size.
Affected products
- M2Team NanaZip < 6.5.1749.0
Timeline
- 2026-06-16: patched: Fixed in version 6.5.1749.0
- 2026-07-10: disclosed: NVD publication date