# CVE-2026-55781: M2Team NanaZip memory exhaustion in UFS and FFS image handler

Source: https://junglewise.ai/threats/cve-2026-55781-m2team-nanazip-memory-exhaustion-in-ufs-and-ffs-image-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55781 · Severity: info · CVSS 2.4 · Published 2026-07-10

NanaZip is an open-source file archiver for Windows. A vulnerability in how it handles certain disk image formats (UFS and FFS) allows a specially crafted, small file to force the application to attempt to allocate massive amounts of system memory. If a user attempts to open or extract such a file, NanaZip may crash or cause the system to become unresponsive due to memory exhaustion.

Technologies: [M2Team NanaZip](https://junglewise.ai/threats/technologies/nanazip). Vendors: [M2Team](https://junglewise.ai/threats/vendors/m2team).

## Quick answers

**Is CVE-2026-55781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55781 being exploited in the wild.

**How severe is CVE-2026-55781?** Informational severity, with a CVSS score of 2.4, published 10 July 2026.

**Which products and versions are affected?** M2Team NanaZip < 6.5.1749.0.

**Is there a fix for CVE-2026-55781?** A patch was published on 2026-06-16: Fixed in version 6.5.1749.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55781 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-55781?** Check whether you run M2Team NanaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in NanaZip's UFS and FFS image handler within `NanaZip.Codecs.Archive.Ufs.cpp`. The parser validates the superblock block size (`fs_bsize`) only against a minimum bound and fails to validate the fragment size (`fs_fsize`). An attacker can provide a crafted UFS image with large 32-bit values in these fields, which are subsequently used as sizes for indirect-block, directory, and extraction buffer allocations. This results in uncontrolled resource consumption (CWE-400/CWE-789), allowing a small image to trigger multi-gigabyte allocations that cause `std::bad_alloc` exceptions or system memory exhaustion. The issue is fixed in version 6.5.1749.0 by implementing proper upper-bound checks and validating fragment sizes against the block size.

## Affected products

- M2Team NanaZip < 6.5.1749.0

## Timeline

- 2026-06-16: patched: Fixed in version 6.5.1749.0
- 2026-07-10: disclosed: NVD publication date

## References

- [https://github.com/M2Team/NanaZip/commit/6415b6bff70bc9c486b49cbbc1982724c67f8338](https://github.com/M2Team/NanaZip/commit/6415b6bff70bc9c486b49cbbc1982724c67f8338)
- [https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0](https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0)
- [https://github.com/M2Team/NanaZip/security/advisories/GHSA-m34h-jf84-m74h](https://github.com/M2Team/NanaZip/security/advisories/GHSA-m34h-jf84-m74h)

## Related threats

- [NanaZip SquashfsHandler heap out-of-bounds read and information disclosure](https://junglewise.ai/threats/cve-2026-54616-nanazip-squashfshandler-heap-out-of-bounds-read-and-information)
- [M2Team NanaZip NULL pointer dereference in NanaZip.Codecs archive handlers](https://junglewise.ai/threats/cve-2026-55783-m2team-nanazip-null-pointer-dereference-in-nanazip-codecs-archive)
- [M2Team NanaZip uncontrolled memory allocation in WebAssembly handler](https://junglewise.ai/threats/cve-2026-55782-m2team-nanazip-uncontrolled-memory-allocation-in-webassembly)
- [M2Team NanaZip uncaught exception in .NET single-file handler](https://junglewise.ai/threats/cve-2026-55780-m2team-nanazip-uncaught-exception-in-net-single-file-handler)
- [M2Team NanaZip heap out-of-bounds read in AVB vbmeta parser](https://junglewise.ai/threats/cve-2026-47223-m2team-nanazip-heap-out-of-bounds-read-in-avb-vbmeta-parser)