CVE-2026-55781: NanaZip UFS Handler DOS Vulnerability

CVE-2026-55781 Overview

CVE-2026-55781 affects NanaZip, the 7-Zip derivative built for the modern Windows experience. The vulnerability resides in the UFS and FFS image handler within NanaZip.Codecs.Archive.Ufs.cpp. The handler validates the superblock block size only against the MINBSIZE lower bound and does not validate the fs_fsize fragment size. Attacker-controlled 32-bit fields flow directly into indirect-block, directory, and extraction buffer allocations. A small crafted UFS image can force multi-gigabyte allocations during archive open or extraction, resulting in memory exhaustion or process termination. The issue is fixed in version 6.5.1749.0 and is classified under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
A crafted UFS or FFS archive can trigger multi-gigabyte memory allocations, causing memory exhaustion and process termination on the host running NanaZip.

Affected Products

NanaZip versions prior to 6.5.1749.0
NanaZip UFS image handler (NanaZip.Codecs.Archive.Ufs.cpp)
NanaZip FFS image handler

Discovery Timeline

2026-07-10 - CVE-2026-55781 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55781

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw in NanaZip's Unix File System (UFS) and Fast File System (FFS) image parser. When NanaZip opens a UFS image, the handler reads superblock metadata that includes 32-bit fields describing the block size and fragment size. Existing validation only rejects block sizes smaller than the MINBSIZE constant. No upper bound is enforced on the block size, and the fragment size fs_fsize is not validated at all.

These unchecked values propagate into allocation calculations for indirect blocks, directory buffers, and extraction buffers. An attacker who supplies a small archive with inflated size fields can force the process to request allocations in the multi-gigabyte range. The behavior triggers on archive open or during extraction, so a user only needs to interact with the malicious archive.

Root Cause

The root cause is missing upper-bound validation on attacker-controlled superblock fields. The handler trusts 32-bit values from the image file when computing buffer sizes. Without a maximum block size constant or a fragment size sanity check, allocation requests scale directly with the crafted metadata.

Attack Vector

Exploitation requires local access and user interaction. A victim opens or extracts a crafted UFS or FFS image using a vulnerable NanaZip build. No elevated privileges are needed on the target account, and no network vector exists. The impact is limited to availability of the NanaZip process and, under heavy allocation pressure, the host system.

cpp

// Patch excerpt: introduces an upper bound for block size
         std::uint32_t Inode = 0;
         UfsInodeInformation Information;
     };
+
+    const std::int32_t g_MaxBlockSize = 65536;
 }
 
 namespace NanaZip::Codecs::Archive

Source: GitHub commit 6415b6bff70bc9c486b49cbbc1982724c67f8338. The patch adds a g_MaxBlockSize constant of 65536 and uses it to bound block-size derived allocations, along with checks on fragment count and size.

Detection Methods for CVE-2026-55781

Indicators of Compromise

Unexpected NanaZip process termination or crash reports immediately after opening .ufs, .img, or FFS-format archives.
Sudden spikes in committed memory attributable to NanaZip.exe or its codec DLLs when handling archive files.
Presence of small UFS or FFS image files (often under a few megabytes) delivered via email, chat, or download that trigger disproportionate resource use.

Detection Strategies

Inventory endpoints for installed NanaZip versions and flag any build earlier than 6.5.1749.0.
Monitor process telemetry for NanaZip.exe memory commit growth exceeding normal archive-handling baselines.
Alert on Windows Error Reporting or application crash events where the faulting module is a NanaZip codec.

Monitoring Recommendations

Log archive open and extraction events initiated by NanaZip through endpoint detection and response telemetry.
Track file arrivals of UFS and FFS image types from untrusted sources such as email attachments and web downloads.
Correlate archive-handler crashes with the source file hash to identify potentially malicious images circulating in the environment.

How to Mitigate CVE-2026-55781

Immediate Actions Required

Upgrade NanaZip to version 6.5.1749.0 or later on all Windows endpoints.
Block or quarantine untrusted UFS and FFS image files at the email gateway and web proxy until patching is complete.
Advise users to avoid opening UFS or FFS archives received from external sources on vulnerable systems.

Patch Information

The fix is available in NanaZip Release 6.5.1749.0. The commit at GitHub commit 6415b6bff70bc9c486b49cbbc1982724c67f8338 introduces an upper bound on block size (g_MaxBlockSize = 65536) and adds validation for fragment count and size. Full details are documented in the GitHub Security Advisory GHSA-m34h-jf84-m74h.

Workarounds

Uninstall or disable NanaZip on systems where upgrading is not immediately feasible and rely on an alternate archiver.
Restrict handling of UFS and FFS image files to isolated analysis systems or sandboxed virtual machines.
Apply per-process memory limits through Windows job objects on shared hosts to contain resource exhaustion from archive parsers.

bash

# Verify installed NanaZip version on Windows (PowerShell)
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version

# Confirm the version is 6.5.1749.0 or later before allowing UFS/FFS handling