EUVD-2026-42956Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no privileges to craft the file; local vector and required user interaction (opening the file) limit reach; impact is availability only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause an attacker-chosen allocation inside Extract, where std::bad_alloc or std::length_error can escape across the COM STDMETHODCALLTYPE boundary and crash the process. This issue is fixed in version 6.5.1749.0.
AnalysisAI
Process crash via uncaught C++ exception in NanaZip's .NET single-file bundle handler affects all versions prior to 6.5.1749.0 on Windows. The extraction buffer is sized from the bundle entry's Size field, which is validated only for sign - not against the actual file content - allowing a crafted archive to trigger an attacker-controlled allocation whose resulting std::bad_alloc or std::length_error propagates across the COM STDMETHODCALLTYPE ABI boundary and terminates the NanaZip process. Impact is limited to denial of service; no public exploit has been identified at time of analysis, and the vendor has released a fix in version 6.5.1749.0.
Technical ContextAI
NanaZip (CPE: cpe:2.3:a:m2team:nanazip:*:*:*:*:*:*:*:*) is a 7-Zip derivative targeting the modern Windows shell, implemented partially in C++ with COM-based codec interfaces. The affected component, NanaZip.Codecs.Archive.DotNetSingleFile.cpp, processes .NET single-file application bundles by reading a bundle entry metadata field named Size to pre-allocate an extraction buffer. The root cause is CWE-248 (Uncaught Exception): C++ exceptions (std::bad_alloc from failed heap allocation, or std::length_error from oversized container construction) are thrown inside a function declared STDMETHODCALLTYPE - a COM calling convention that requires exception-free returns. Because the Size field is not validated against the actual embedded file's real byte length, an attacker can encode an arbitrarily large value, forcing an allocation that fails and throws an exception that crosses the COM ABI boundary, which is undefined behavior in practice on Windows MSVC and results in process termination.
RemediationAI
Upgrade NanaZip to version 6.5.1749.0 or later, which contains the vendor-released patch (https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0; fix commit https://github.com/M2Team/NanaZip/commit/ad62e3b4970b9f01e924c99094d6fed7a42f849a). Organizations unable to upgrade immediately should avoid opening .NET single-file bundles from untrusted sources with NanaZip and instead use an alternative archiver for such files; this eliminates exposure entirely since the flaw is scoped to NanaZip's DotNetSingleFile codec path. No additional workarounds are documented in the advisory.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today