Executive brief
NanaZip is an open-source file archiver for Windows. A vulnerability in how it handles certain disk image formats (UFS and FFS) allows a specially crafted, small file to force the application to attempt to allocate massive amounts of system memory. If a user attempts to open or extract such a file, NanaZip may crash or cause the system to become unresponsive due to memory exhaustion.
Technical details
A vulnerability exists in NanaZip's UFS and FFS image handler within `NanaZip.Codecs.Archive.Ufs.cpp`. The parser validates the superblock block size (`fs_bsize`) only against a minimum bound and fails to validate the fragment size (`fs_fsize`). An attacker can provide a crafted UFS image with large 32-bit values in these fields, which are subsequently used as sizes for indirect-block, directory, and extraction buffer allocations. This results in uncontrolled resource consumption (CWE-400/CWE-789), allowing a small image to trigger multi-gigabyte allocations that cause `std::bad_alloc` exceptions or system memory exhaustion. The issue is fixed in version 6.5.1749.0 by implementing proper upper-bound checks and validating fragment sizes against the block size.
Affected products
- M2Team NanaZip < 6.5.1749.0
Timeline
- 2026-06-16: patched: Fixed in version 6.5.1749.0
- 2026-07-10: disclosed: NVD publication date