Executive brief
NanaZip is an open-source file archiver for Windows. A flaw in how the application handles certain archive types (such as WebAssembly or ElectronAsar) can cause the program to crash when a user attempts to test or extract all files from a specially crafted archive. This results in a denial of service where the application becomes unresponsive or closes unexpectedly during file operations.
Technical details
A NULL pointer dereference exists in NanaZip's seven in-house IInArchive handlers within NanaZip.Codecs. When the archive engine signals a 'test' or 'extract all' operation, it passes a NULL Indices array and a NumItems value of 0xFFFFFFFF. The vulnerable handlers (WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile) fail to check for the NULL array before dereferencing it during the GetStream call. An attacker can trigger this by providing a malicious archive file that causes a process crash when the victim performs standard extraction or testing actions. The issue is resolved in version 6.5.1749.0 by correctly using the pre-computed ActualFileIndex.
Affected products
- M2Team NanaZip < 6.5.1749.0
Timeline
- 2026-06-16: patched: Fixed in version 6.5.1749.0
- 2026-06-16: advisory: GitHub Security Advisory GHSA-q67r-9cfh-xc29 published
- 2026-07-10: disclosed: CVE-2026-55783 published to NVD