CVE-2026-55782 Overview
CVE-2026-55782 is a resource exhaustion vulnerability [CWE-400] in NanaZip, the 7-Zip derivative built for modern Windows. The flaw resides in the WebAssembly archive handler at NanaZip.Codecs.Archive.WebAssembly.cpp. The handler allocates buffers using attacker-controlled 32-bit section and custom-name length fields without validating those values against the actual file data. A small crafted WebAssembly module can force multi-gigabyte allocations during listing or extraction. This triggers memory exhaustion or process termination. The issue affects NanaZip versions prior to 6.5.1749.0 and is resolved in 6.5.1749.0.
Critical Impact
A crafted WebAssembly archive can trigger uncontrolled memory allocation in NanaZip, causing memory exhaustion or process termination on the local system when a user opens or extracts the file.
Affected Products
- NanaZip versions prior to 6.5.1749.0
- NanaZip.Codecs.Archive.WebAssembly.cpp archive handler component
- Windows systems using NanaZip for WebAssembly archive processing
Discovery Timeline
- 2026-07-10 - CVE-2026-55782 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-55782
Vulnerability Analysis
The vulnerability sits in NanaZip's WebAssembly archive handler. When parsing a WebAssembly module, the handler reads 32-bit length fields for sections and custom-name entries directly from the file. These values control the size of subsequent buffer allocations, including std::string and std::vector allocations for the CustomName field and Information.Size records.
The handler does not compare the declared NameSize against the surrounding BundleSize or the actual file length. An attacker can declare NameSize values up to 4 GB in a module only a few bytes long. The handler then attempts to allocate matching buffers on the heap. This drives the process into memory exhaustion or forces an unhandled std::bad_alloc that terminates the process.
Root Cause
The root cause is missing validation of untrusted length fields. NameSize and section size values are consumed as allocation sizes without bounds checks against remaining data. Allocation failures were also uncaught, converting an out-of-memory condition into process termination.
Attack Vector
Exploitation requires local user interaction. A user must open or extract a crafted WebAssembly archive in NanaZip. The impact is limited to denial of service on the local process. There is no code execution, data disclosure, or integrity impact.
// Patch: NanaZip.Codecs/NanaZip.Codecs.Archive.WebAssembly.cpp
// Fix 1: Validate NameSize against BundleSize before allocation
}
Size -= ProcessedBytes;
}
+ if (NameSize > BundleSize)
+ {
+ break;
+ }
if (NameSize)
{
try
// Fix 2: Catch std::bad_alloc on string allocation
if (NameSize)
{
- CustomName = std::string(NameSize, '\0');
+ try
+ {
+ CustomName = std::string(NameSize, '\0');
+ }
+ catch (const std::bad_alloc&)
+ {
+ break;
+ }
// Fix 3: Introduce bounded extraction buffer size
const char g_WebAssemblySignature[] = { '\0', 'a', 's', 'm' };
+ const std::size_t g_ExtractBufferSize = 1UL << 16;
Source: NanaZip commit 92b12a6, NanaZip commit 1ce90f2, NanaZip commit 56aee89
Detection Methods for CVE-2026-55782
Indicators of Compromise
- NanaZip process (NanaZip.exe) crashes or terminates unexpectedly after opening a .wasm file
- Sudden spikes in committed memory attributed to NanaZip during archive listing or extraction
- WebAssembly files with signature \0asm whose declared section or NameSize fields far exceed the on-disk file size
Detection Strategies
- Inventory endpoints for NanaZip installations and flag versions below 6.5.1749.0
- Monitor for std::bad_alloc or unhandled exception crash events tied to NanaZip in the Windows Application event log
- Inspect WebAssembly archives at the gateway for malformed custom-name sections whose length fields exceed remaining bundle size
Monitoring Recommendations
- Track process memory growth and abnormal exits for archiver utilities using endpoint telemetry
- Alert on repeated NanaZip crashes originating from the same user or file source
- Log file open events for .wasm archives handled by NanaZip to correlate with any resulting process termination
How to Mitigate CVE-2026-55782
Immediate Actions Required
- Upgrade NanaZip to version 6.5.1749.0 or later on all Windows endpoints
- Avoid opening WebAssembly archives from untrusted sources until patching is complete
- Remove or disable the WebAssembly archive handler association if the feature is not required
Patch Information
The fix is delivered in NanaZip release 6.5.1749.0. The maintainer commits validate NameSize against BundleSize, wrap std::string allocations in try/catch blocks for std::bad_alloc, and introduce a bounded extraction buffer of 1UL << 16 bytes. Additional details are available in GitHub Security Advisory GHSA-qxhc-2v6p-wm8m.
Workarounds
- Uninstall NanaZip or replace it with an alternative archiver until the update is deployed
- Block delivery of .wasm files through email and web proxies where WebAssembly modules are not a business requirement
- Restrict file associations so that .wasm files do not open in NanaZip by default
# Verify installed NanaZip version on Windows via PowerShell
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version
# Upgrade via winget to the patched release
winget upgrade --id M2Team.NanaZip --version 6.5.1749.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
