CVE-2026-55782

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2
https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae
https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6
https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0
https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m
https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) NanaZip es el derivado de 7-Zip diseñado para la experiencia moderna de Windows. Antes de la versión 6.5.1749.0, el gestor de archivos WebAssembly de NanaZip en NanaZip.Codecs.Archive.WebAssembly.cpp asigna búferes de una sección de 32 bits controlada por el atacante y campos de longitud de nombre personalizados sin validarlos contra los datos presentes en el archivo. Un módulo pequeño y malintencionado puede forzar asignaciones de varios gigabytes durante la enumeración o extracción a través de las rutas de asignación de NameSize, Information.Size y std::string o vector, causando agotamiento de memoria o terminación del proceso. Este problema se solucionó en la versión 6.5.1749.0.

Information

Published : 2026-07-10 17:17

Updated : 2026-10-25 15:10

NVD link : CVE-2026-55782

Mitre link : CVE-2026-55782

CVE.ORG link : CVE-2026-55782

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-55782", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55782", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T02:00:08.437231Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "M2Team", "product": "NanaZip", "versions": [{"status": "affected", "version": "< 6.5.1749.0"}]}]}], "published": "2026-07-10T17:17:00.017", "references": [{"url": "https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m", "source": "security-advisories@github.com"}, {"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0."}, {"lang": "es", "value": "NanaZip es el derivado de 7-Zip dise\u00f1ado para la experiencia moderna de Windows. Antes de la versi\u00f3n 6.5.1749.0, el gestor de archivos WebAssembly de NanaZip en NanaZip.Codecs.Archive.WebAssembly.cpp asigna b\u00faferes de una secci\u00f3n de 32 bits controlada por el atacante y campos de longitud de nombre personalizados sin validarlos contra los datos presentes en el archivo. Un m\u00f3dulo peque\u00f1o y malintencionado puede forzar asignaciones de varios gigabytes durante la enumeraci\u00f3n o extracci\u00f3n a trav\u00e9s de las rutas de asignaci\u00f3n de NameSize, Information.Size y std::string o vector, causando agotamiento de memoria o terminaci\u00f3n del proceso. Este problema se solucion\u00f3 en la versi\u00f3n 6.5.1749.0."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}