CVE-2026-55780 Details
Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause an attacker-chosen allocation inside Extract, where std::bad_alloc or std::length_error can escape across the COM STDMETHODCALLTYPE boundary and crash the process. This issue is fixed in version 6.5.1749.0.
A vulnerability exists in NanaZip versions prior to 6.5.1749.0 within the .NET single-file bundle extraction process. The issue arises because the extraction buffer is allocated based on the bundle entry's size, which is only sign-checked and not validated against the actual file size. This flaw allows a crafted bundle to cause an attacker-controlled allocation, leading to a `std::bad_alloc` or `std::length_error` exception escaping across the COM `STDMETHODCALLTYPE` boundary, potentially crashing the application. The vulnerability can be exploited when a user extracts an entry from a manipulated single-file bundle.
Users can upgrade to NanaZip version 6.5.1749.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-ppm9-5267-rq72 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/M2Team/NanaZip/commit/ad62e3b4970b9f01e924c99094d6fed7a42f849a | [email protected] | Source CodeVendor |
| https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0 | [email protected] | Release NotesVendor |
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-ppm9-5267-rq72 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| M2Team NanaZip | <= 6.5 Preview (6.5.1742.0) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |