NanaZip EUVD-2026-42956

Exploitation requires: (1) the victim has NanaZip prior to 6.5.1749.0 installed on Windows; (2) the victim opens a crafted .NET single-file bundle (a specific archive format) using NanaZip, providing the DotNetSingleFile codec code path; (3) passive user interaction (UI:P) - the victim must initiate the file open action. Exploitation is limited to denial of service (process crash) - no code execution, privilege escalation, or data exfiltration is possible via this path. The attack does not succeed against other archive formats or other archiver tools. No network-facing surface is involved; the bundle must be present on the local filesystem for NanaZip to process it.

The CVSS 4.0 score of 2.4 (AV:L/AC:L/AT:N/PR:L/UI:P/VA:L) accurately reflects the constrained real-world impact. The attack vector is local - exploitation requires the victim to open a specially crafted .NET single-file bundle using NanaZip, representing meaningful user-interaction friction. The impact is strictly limited to availability (process crash) with no confidentiality or integrity consequence. No EPSS data was provided in source intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No publicly available POC code was identified. The vulnerability is straightforward in concept but requires file delivery and user action, making mass automated exploitation implausible. This is a low-priority remediation item for most organizations - highest concern applies to developer or security-research workflows where untrusted .NET single-file bundles may be routinely handled via NanaZip. SSVC assessment: exploitation status is none confirmed, technical impact is partial (DoS only), not automatable due to required UI.

An attacker crafts a .NET single-file bundle with a bundle entry Size field set to a value far exceeding available memory or std::vector's max_size, then delivers it to a target via email attachment, download link, or shared drive. When the victim opens the file in a vulnerable NanaZip version, the DotNetSingleFile codec attempts to allocate the attacker-specified buffer, a C++ exception propagates across the COM boundary, and NanaZip crashes. The crash is repeatable with the same file but offers no further exploitation primitive beyond process termination.