NanaZip, an open‑source .NET archive extractor, has a flaw in its single‑file parser where an integer underflow can be triggered during the header‑size calculation of a crafted bundle. The underflow leads to an unbounded memory allocation attempt when opening the archive, effectively exhausting system resources and causing a denial‑of‑service condition. The weakness corresponds to CWE‑191 (Integer Underflow).

The vulnerability affects M2Team’s NanaZip starting at version 5.0.1252.0 and all releases up to but not including 6.0.1638.0 and 6.5.1638.0. Users running any of those earlier builds, particularly when processing untrusted archives, are vulnerable. The issue is fixed in NanaZip 6.0.1638.0 and 6.5.1638.0.

The CVSS base score of 5.1 indicates moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a maliciously crafted archive that the application processes; the attack vector is therefore local file opening or via any avenue that allows an attacker to supply an archive to NanaZip. In such scenarios, the attacker could trigger a DoS by causing the application to attempt an unbounded memory allocation.