EUVD-2026-42954Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no system privileges - only delivery of a crafted file; user must open it (UI:R); impact is limited to NanaZip process availability.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.
AnalysisAI
Memory exhaustion in NanaZip's WebAssembly archive handler (prior to 6.5.1749.0) allows a crafted .wasm file to trigger multi-gigabyte heap allocations by supplying oversized 32-bit NameSize or Information.Size fields that are consumed without bounds validation in NanaZip.Codecs.Archive.WebAssembly.cpp. When a user opens or lists such an archive, NanaZip attempts to satisfy the inflated allocations via std::string or std::vector paths, exhausting process memory and causing a crash. No active exploitation or public exploit code has been identified at time of analysis; the impact is strictly limited to NanaZip process availability with no confidentiality or integrity consequence.
Technical ContextAI
NanaZip (CPE cpe:2.3:a:m2team:nanazip) is an open-source Windows file archiver derived from 7-Zip that extends support to WebAssembly (.wasm) module archives through a dedicated handler in NanaZip.Codecs.Archive.WebAssembly.cpp. The WebAssembly binary format encodes section sizes and custom-section name lengths as 32-bit fields; the vulnerable handler reads these values and passes them directly to C++ STL allocation paths (std::string and std::vector constructors) without first checking that the claimed size is consistent with the bytes actually present in the file. CWE-400 (Uncontrolled Resource Consumption) characterizes the root cause: attacker-supplied numeric values flow unvalidated into heap allocation calls, so a file of a few kilobytes can request allocations measured in gigabytes. Three discrete code paths - NameSize, Information.Size, and the STL container constructors - are each independently exploitable via a single crafted file.
RemediationAI
Upgrade NanaZip to version 6.5.1749.0 or later, which resolves all three vulnerable allocation paths; the fix is confirmed by vendor advisory GHSA-qxhc-2v6p-wm8m and three discrete commits: https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2, https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae, and https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6. For environments that cannot immediately upgrade, a practical compensating control is to avoid opening .wasm archives from untrusted sources in NanaZip; the trade-off is that this restriction must be enforced by policy since NanaZip provides no built-in file-type filtering. No side effects of the patch upgrade have been reported by the vendor.
Nanazip versions up to 6.0.1630.0 is affected by loop with unreachable exit condition (infinite loop) (CVSS 7.5).
NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser
NanaZip versions 5.0.1252.0 through 6.5.1637.0 contain an out-of-bounds memory access flaw in the UFS file parser that c
Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc
NanaZip versions 5.0.1252.0 through 6.0.1629.0 are vulnerable to denial of service through malformed ROMFS archives that
NanaZip versions 5.0.1252.0 through 6.5.1637.x contain an integer underflow in the .NET Single File Application parser t
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a use
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser allows unauthenticated remote attac
Heap out-of-bounds read in NanaZip's Android Verified Boot (AVB) vbmeta image parser crashes the application and may lea
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) ena
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before
Heap out-of-bounds read in NanaZip's inherited 7-Zip LvmHandler component allows an unauthenticated remote attacker to c
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today