CVE-2026-55782 Details
Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.
A denial-of-service vulnerability has been identified in NanaZip versions prior to 6.5.1749.0. The issue arises in the WebAssembly archive handler, where buffers are allocated based on attacker-controlled length fields without proper validation. This flaw allows a crafted module to trigger multi-gigabyte allocations, leading to memory exhaustion or process termination. The vulnerability is rooted in the handling of custom section name lengths and section sizes, which are read as 32-bit values and can be manipulated to cause excessive memory use.
Users can upgrade to NanaZip version 6.5.1749.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2 | [email protected] | Source CodeVendor |
| https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae | [email protected] | Source CodeVendor |
| https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6 | [email protected] | Source CodeVendor |
| https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0 | [email protected] | AdvisoryBundleRelease NotesVendor |
| https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| M2Team NanaZip | <= 6.5.1742.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |