CVE-2026-55780: NanaZip DOS Vulnerability

CVE-2026-55780 Overview

CVE-2026-55780 affects NanaZip, the 7-Zip derivative built for the modern Windows experience. The vulnerability resides in the .NET single-file bundle handler implemented in NanaZip.Codecs.Archive.DotNetSingleFile.cpp. The handler sizes its extraction buffer from the bundle entry Size field, which is only validated for sign and not against the actual file size. A crafted bundle triggers an attacker-chosen allocation inside Extract, allowing std::bad_alloc or std::length_error to propagate across the COM STDMETHODCALLTYPE boundary and crash the process. The issue is fixed in version 6.5.1749.0.

Critical Impact
A malicious .NET single-file bundle can force an uncaught C++ exception across a COM boundary, resulting in denial of service through process termination [CWE-248].

Affected Products

NanaZip versions prior to 6.5.1749.0
NanaZip .NET single-file bundle archive handler
Windows systems using NanaZip to extract untrusted archives

Discovery Timeline

2026-07-10 - CVE-2026-55780 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55780

Vulnerability Analysis

The flaw is an uncaught exception vulnerability [CWE-248] in NanaZip's .NET single-file bundle archive handler. When parsing a bundle, the handler reads the Size field from each bundle entry and uses it directly to size an in-memory extraction buffer. The only validation applied is a sign check, so any non-negative value passes, including sizes that exceed available memory or the actual file length.

During Extract, the handler requests an allocation of the attacker-controlled size. When this allocation fails or exceeds container limits, the C++ runtime throws std::bad_alloc or std::length_error. Because the handler does not catch these exceptions, they escape across the COM STDMETHODCALLTYPE boundary. Propagating a C++ exception across a COM interface is undefined behavior and terminates the NanaZip process.

Root Cause

The root cause is missing bounds validation on the bundle entry Size field in NanaZip.Codecs.Archive.DotNetSingleFile.cpp. The handler trusts the size value from the archive metadata without cross-checking it against the real file size or reasonable upper bounds. It also lacks a try/catch wrapper at the COM method boundary to convert C++ exceptions into HRESULT values.

Attack Vector

Exploitation requires a local user to open or extract a maliciously crafted .NET single-file bundle archive with NanaZip. User interaction is required, and the attacker needs only low privileges. The impact is limited to availability, causing the NanaZip process to crash. There is no confidentiality or integrity impact and no evidence of code execution potential in the published advisory.

The vulnerability mechanism is described in prose because no verified exploit code has been published. See the GitHub Security Advisory GHSA-ppm9-5267-rq72 for authoritative technical details.

Detection Methods for CVE-2026-55780

Indicators of Compromise

Unexpected termination of NanaZip.exe or associated codec host processes when opening archives from untrusted sources.
Windows Error Reporting (WER) crash dumps referencing NanaZip.Codecs modules and std::bad_alloc or std::length_error.
Presence of .NET single-file bundle archives delivered through email, downloads, or removable media prior to observed crashes.

Detection Strategies

Monitor endpoint telemetry for NanaZip.exe crash events correlated with recent archive open or extract actions.
Inventory installed NanaZip versions across managed endpoints and flag any build older than 6.5.1749.0.
Inspect archive file metadata for .NET single-file bundles containing implausibly large entry Size values.

Monitoring Recommendations

Collect Application event log entries with source Windows Error Reporting and faulting module names matching NanaZip codec binaries.
Track process creation and exit codes for NanaZip.exe to identify repeated abnormal terminations from a single user or file.
Alert on delivery of .NET bundle archives to users who routinely handle third-party or untrusted content.

How to Mitigate CVE-2026-55780

Immediate Actions Required

Upgrade all NanaZip installations to version 6.5.1749.0 or later.
Avoid opening .NET single-file bundle archives from untrusted or unverified sources until the update is deployed.
Distribute the update through managed software deployment channels to ensure enterprise-wide coverage.

Patch Information

The fix is available in NanaZip release 6.5.1749.0. The corrective change is tracked in the upstream repository. Refer to the GitHub commit ad62e3b and the NanaZip 6.5.1749.0 release for the patched sources and binaries. The patch adds validation of the bundle entry Size field against the real file size and prevents exceptions from crossing the COM boundary.

Workarounds

Restrict extraction of .NET single-file bundle archives to trusted sources only until patching is complete.
Use an alternative archive tool for handling untrusted bundle files on unpatched systems.
Apply application allowlisting policies to control which users can run NanaZip against externally sourced archives.

bash

# Verify installed NanaZip version on Windows endpoints
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version

# Enforce the fixed version via package manager (winget)
winget upgrade --id M2Team.NanaZip --version 6.5.1749.0