CVE-2026-27710: NanaZip Denial-of-Service Vulnerability

CVE-2026-27710 Overview

CVE-2026-27710 is an integer underflow vulnerability affecting NanaZip, an open source file archiver. The flaw exists in NanaZip's .NET Single File Application parser, where a crafted bundle can force an integer underflow in the header-size calculation. This triggers an unbounded memory allocation attempt when the archive is opened, resulting in a denial-of-service condition.

Critical Impact

A maliciously crafted archive file can cause NanaZip to exhaust system memory resources, leading to application crash and potential system instability when users attempt to open the file.

Affected Products

• NanaZip versions 5.0.1252.0 to versions prior to 6.0.1638.0
• NanaZip versions 5.0.1252.0 to versions prior to 6.5.1638.0

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27710 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27710

Vulnerability Analysis

This vulnerability is classified under CWE-191 (Integer Underflow). The flaw resides in the parsing logic for .NET Single File Application bundles within NanaZip. When processing a specially crafted archive, the header-size calculation performs arithmetic operations that can result in an integer underflow. This miscalculation causes the application to attempt an unbounded memory allocation, which can exhaust available system resources.

The attack requires local access and user interaction, as a victim must be convinced to open a malicious archive file. While the vulnerability does not compromise confidentiality or integrity, it poses a significant availability impact by allowing attackers to crash the application or potentially destabilize the system through memory exhaustion.

Root Cause

The root cause is improper handling of integer arithmetic during header-size calculation in the .NET Single File Application parser. When parsing malformed bundle headers, the calculation can produce an underflowed value that wraps around to an extremely large number. This value is then used to allocate memory, resulting in an allocation request that exceeds available system resources.

Attack Vector

The attack vector is local, requiring an attacker to deliver a malicious archive file to the target system. The exploitation scenario involves:

1. An attacker crafts a malicious .NET Single File Application bundle with manipulated header values designed to trigger the integer underflow
2. The crafted archive is delivered to a victim through various means such as email attachments, downloads, or file sharing
3. When the victim opens the archive using NanaZip, the parser attempts to process the malformed header
4. The integer underflow occurs during header-size calculation, producing an invalid memory allocation size
5. NanaZip attempts to allocate an excessive amount of memory, leading to resource exhaustion and application crash

The vulnerability mechanism involves manipulating header fields in the .NET Single File Application bundle format to cause arithmetic underflow. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-27710

Indicators of Compromise

• Unexpected NanaZip application crashes when opening archive files
• System memory usage spikes correlated with archive file operations
• Presence of suspicious .NET Single File Application bundles with malformed headers
• NanaZip process consuming abnormally high memory before termination

Detection Strategies

• Monitor for NanaZip process crashes and abnormal termination events in system logs
• Implement endpoint detection rules to identify memory exhaustion patterns associated with archive file operations
• Deploy file scanning solutions to detect malformed archive headers before user access
• Enable application crash monitoring and correlate events with file access patterns

Monitoring Recommendations

• Configure endpoint protection to alert on rapid memory consumption by NanaZip processes
• Enable Windows Error Reporting to capture crash dumps for forensic analysis
• Monitor file system activity for suspicious archive files being accessed
• Implement SentinelOne Singularity XDR to detect behavioral anomalies during archive processing

How to Mitigate CVE-2026-27710

Immediate Actions Required

• Update NanaZip to version 6.0.1638.0 or 6.5.1638.0 immediately
• Review any archive files received from untrusted sources before opening
• Consider temporarily restricting NanaZip usage until patches are applied
• Educate users about the risks of opening archives from unknown sources

Patch Information

The NanaZip development team has addressed this vulnerability in versions 6.0.1638.0 and 6.5.1638.0. Users should upgrade to these patched versions immediately. The fix implements proper bounds checking during header-size calculation to prevent integer underflow conditions. For more information, see the GitHub Security Advisory.

Workarounds

• Avoid opening archive files from untrusted or unknown sources until the system is patched
• Use alternative archive utilities for handling .NET Single File Application bundles temporarily
• Implement application sandboxing to limit the impact of memory exhaustion attacks
• Configure system resource limits to prevent single applications from exhausting all available memory

# Verify NanaZip version on Windows
# Check installed version through Settings > Apps > Installed Apps
# Or via PowerShell:
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version