CVE-2026-27709: NanaZip Information Disclosure Vulnerability

CVE-2026-27709 Overview

CVE-2026-27709 is an out-of-bounds read vulnerability in NanaZip, an open source file archiver. The vulnerability exists in NanaZip's .NET Single File Application parser, specifically in the manifest parsing functionality. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a crafted bundle can provide a malformed RelativePathLength value that causes the parser to construct a std::string from memory beyond the HeaderBuffer. This can lead to application crashes and potential in-process memory disclosure.

Critical Impact

Attackers can craft malicious archive bundles that trigger out-of-bounds memory reads, potentially exposing sensitive in-process memory data or causing denial of service through application crashes.

Affected Products

• NanaZip versions 5.0.1252.0 to versions prior to 6.0.1638.0
• NanaZip versions 5.0.1252.0 to versions prior to 6.5.1638.0

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27709 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27709

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read). The flaw exists in NanaZip's .NET Single File Application parser, which is responsible for extracting and processing bundled .NET applications distributed as single-file executables.

When parsing the manifest of a .NET Single File Application bundle, the parser reads length fields from the bundle header to determine the size of various strings, including the relative path of files contained within the bundle. A crafted bundle can specify a RelativePathLength value that exceeds the actual bounds of the HeaderBuffer. When the parser attempts to construct a std::string using this length, it reads memory beyond the allocated buffer.

The consequences of this vulnerability include denial of service through application crashes when invalid memory is accessed, as well as potential information disclosure if the out-of-bounds read successfully retrieves data from adjacent memory regions. This could expose sensitive application data, heap metadata, or other in-process information.

Root Cause

The root cause of this vulnerability is insufficient validation of the RelativePathLength field within the .NET Single File Application manifest parser. The parser fails to verify that the specified length does not exceed the boundaries of the HeaderBuffer before using it to construct string objects. This missing bounds check allows an attacker-controlled length value to cause memory reads beyond the allocated buffer region.

Attack Vector

This vulnerability requires local access and user interaction to exploit. An attacker must craft a malicious .NET Single File Application bundle with a specially constructed manifest containing an oversized RelativePathLength value. The victim must then open or process this malicious bundle using NanaZip.

The attack scenario involves distributing the malicious archive file through social engineering, email attachments, download sites, or other file sharing mechanisms. When a user attempts to view, extract, or otherwise process the malicious bundle with an affected version of NanaZip, the out-of-bounds read is triggered during manifest parsing.

The vulnerability mechanism works as follows: during manifest parsing, NanaZip reads the RelativePathLength field from the bundle header, then uses this value as the length parameter when constructing a std::string from data in HeaderBuffer. Without proper bounds checking, the string constructor reads past the end of HeaderBuffer, accessing adjacent memory. Depending on memory layout, this may cause an immediate crash or return out-of-bounds data as part of the string.

Detection Methods for CVE-2026-27709

Indicators of Compromise

• Unexpected NanaZip application crashes when processing .NET Single File Application bundles
• Error logs indicating memory access violations or segmentation faults during archive extraction
• Presence of malformed .NET Single File Application bundles with anomalous header field values
• Unusual file processing activity involving bundles with oversized manifest length fields

Detection Strategies

• Monitor for NanaZip process crashes with memory access violation exceptions
• Implement file integrity monitoring to detect malicious archive files with abnormal header structures
• Deploy endpoint detection rules to identify crashes patterns consistent with out-of-bounds read exploitation
• Analyze crash dumps for evidence of memory reads beyond expected buffer boundaries

Monitoring Recommendations

• Enable application crash reporting and logging for NanaZip processes
• Implement EDR monitoring for memory access violations in file archiver applications
• Monitor for suspicious .NET Single File Application bundles received via email or downloaded from external sources
• Configure SentinelOne to detect and alert on process crashes indicative of memory corruption exploitation attempts

How to Mitigate CVE-2026-27709

Immediate Actions Required

• Upgrade NanaZip to version 6.0.1638.0 or 6.5.1638.0 immediately
• Avoid opening untrusted .NET Single File Application bundles until patched
• Implement file filtering to quarantine suspicious archive files pending analysis
• Enable endpoint protection monitoring to detect exploitation attempts

Patch Information

The vulnerability has been addressed in NanaZip versions 6.0.1638.0 and 6.5.1638.0. Users should upgrade to one of these fixed versions as soon as possible. For more information, refer to the GitHub Security Advisory.

Workarounds

• Temporarily disable or restrict processing of .NET Single File Application bundles until the update can be applied
• Implement organizational policies to prevent users from opening archive files from untrusted sources
• Use alternative archive utilities that are not affected by this vulnerability for processing suspicious files
• Consider implementing file sandboxing to isolate archive extraction operations from the main system

Upgrading to the patched version is the recommended mitigation. Users can download the latest version from the official NanaZip repository and install it following standard procedures for their platform.