CVE-2026-55783: NanaZip NULL Pointer DOS Vulnerability

CVE-2026-55783 Overview

CVE-2026-55783 is a NULL pointer dereference vulnerability in NanaZip, the 7-Zip derivative built for modern Windows. Versions prior to 6.5.1749.0 contain seven in-house IInArchive handlers in NanaZip.Codecs that unconditionally dereference the caller-supplied Indices array inside Extract. When the archive engine signals extract-all by passing Indices as NULL and NumItems as 0xFFFFFFFF, the handlers crash the process. The affected handlers cover WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archive formats. The issue is tracked under [CWE-476] and resolved in version 6.5.1749.0.

Critical Impact
A local user opening a crafted archive with Test or Extract All triggers a NULL pointer dereference, causing NanaZip to crash. Availability impact is limited to the NanaZip process.

Affected Products

NanaZip versions prior to 6.5.1749.0
NanaZip.Codecs in-house IInArchive handlers (WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, DotNetSingleFile)
Windows systems running vulnerable NanaZip builds

Discovery Timeline

2026-07-10 - CVE-2026-55783 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55783

Vulnerability Analysis

The flaw resides in the Extract method implemented by seven in-house IInArchive handlers within NanaZip.Codecs. The 7-Zip archive engine invokes Extract with two calling conventions. Callers may pass an explicit Indices array with NumItems set to the number of entries, or signal extract-everything by passing Indices as NULL with NumItems set to 0xFFFFFFFF. The vulnerable handlers do not check for the sentinel case and index directly into Indices[i] for every iteration.

The result is a deterministic NULL pointer dereference during the standard Test archive or Extract All code paths. User interaction is required, and the attack vector is local. The impact is limited to a crash of the NanaZip process, with no observed confidentiality or integrity impact.

Root Cause

The handlers for WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archives dereference Indices[i] without first checking whether Indices == NULL. When the engine signals extract-all, the loop must derive the file index from the loop counter rather than from the pointer. The fix computes an ActualFileIndex and passes it to ExtractCallback->GetStream instead of Indices[i].

Attack Vector

Exploitation requires a local user to open a crafted archive in one of the seven affected formats and initiate Test or Extract All. NanaZip crashes when the handler enters the extract-everything code path. There is no evidence of memory corruption beyond the NULL dereference, and no code execution primitive is described in the advisory.

cpp

// Patch excerpt: NanaZip.Codecs.Archive.DotNetSingleFile.cpp
// and NanaZip.Codecs.Archive.ElectronAsar.cpp
                ISequentialOutStream* OutputStream = nullptr;
                hr = ExtractCallback->GetStream(
-                   Indices[i],
+                   ActualFileIndex,
                    &OutputStream,
                    AskMode);
                if (FAILED(hr))
// Source: https://github.com/M2Team/NanaZip/commit/5d74d90b737ac7096e5d944a5a3070c5c6a8f894

The patch replaces the unconditional Indices[i] dereference with ActualFileIndex, which is derived safely regardless of whether the caller passed a NULL Indices pointer. See the GitHub Security Advisory GHSA-q67r-9cfh-xc29 for the full patch set covering all seven handlers.

Detection Methods for CVE-2026-55783

Indicators of Compromise

Unexpected termination of the NanaZip.exe process during Test or Extract All operations
Windows Error Reporting (WER) or Application crash entries citing an access violation in NanaZip.Codecs.dll
Presence of WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, or DotNetSingleFile archives from untrusted sources

Detection Strategies

Inventory installed NanaZip versions across managed Windows endpoints and flag any build older than 6.5.1749.0
Monitor for repeated NanaZip process crashes correlated with archive handling activity
Alert on delivery of archives with the affected format extensions from external sources such as email or downloads

Monitoring Recommendations

Collect Windows Application event logs for faulting module NanaZip.Codecs.dll and exception code 0xC0000005
Track file-open telemetry for the seven vulnerable archive formats on endpoints running unpatched NanaZip
Correlate crash telemetry with recent archive downloads to identify targeted delivery attempts

How to Mitigate CVE-2026-55783

Immediate Actions Required

Upgrade NanaZip to version 6.5.1749.0 or later on all Windows endpoints
Identify unmanaged installations of NanaZip via software inventory and remove or update them
Advise users to avoid opening WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, or DotNetSingleFile archives from untrusted sources until patched

Patch Information

The vendor released the fix in NanaZip Release 6.5.1749.0. The corresponding source change is documented in GitHub Commit 5d74d90b and the coordinated disclosure is published under GHSA-q67r-9cfh-xc29.

Workarounds

Do not use the Test or Extract All functions on archives of the seven affected formats until NanaZip is updated
Restrict handling of untrusted archives to a sandboxed or non-privileged user account
Where operationally feasible, uninstall NanaZip and use a patched alternative archiver until the update is deployed

bash

# Verify installed NanaZip version via PowerShell
Get-AppxPackage -Name "*NanaZip*" | Select-Object Name, Version

# Uninstall vulnerable NanaZip package (run as administrator)
Get-AppxPackage -Name "*NanaZip*" | Remove-AppxPackage