Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-55781NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields

Low 2.4

In plain English

A low-severity uncontrolled resource consumption in NanaZip from M2Team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)2.4Low

Exploit odds (30 days)0.2%top 94.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fs_fsize fragment size, allowing attacker-controlled 32-bit fields to flow into indirect-block, directory, and extraction buffer allocations. A tiny crafted UFS image can force multi-gigabyte allocations during open or extraction, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.

Affected products (as reported)

Vendor	Product	Versions
M2Team	NanaZip	< 6.5.1749.0

Weakness: CWE-400, CWE-789 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/M2Team/NanaZip/security/advisories/GHSA-m34h-jf84-m74h x_refsource_CONFIRM
https://github.com/M2Team/NanaZip/commit/6415b6bff70bc9c486b49cbbc1982724c67f8338 x_refsource_MISC
https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0 x_refsource_MISC