The vulnerability resides in NanaZip, a modern Windows-friendly variation of 7‑Zip, where the .NET single‑file bundle handler allocates its extraction buffer based solely on the entry Size field. This field is only checked for sign but is not compared against the actual file size. A crafted bundle can cause an attacker‑chosen allocation that triggers a std::bad_alloc or std::length_error during extraction. Because the exception propagates across the COM STDMETHODCALLTYPE boundary, the process is terminated, resulting in a denial‑of‑service. The weakness is catalogued as CWE‑248 (Uncaught Exception) and CWE‑400 (Uncontrolled Resource Consumption).

The product affected is NanaZip released by M2Team. Versions earlier than 6.5.1749.0 are vulnerable. The specific component is NanaZip.Codecs.Archive.DotNetSingleFile in that package. The upgrade to 6.5.1749.0 or newer resolves the issue.

The CVSS score of 2.4 indicates a low severity impact. The EPSS score of <1% suggests a very low probability of exploitation, and the weakness is not listed in the CISA KEV catalog, indicating limited widespread exploitation. The attack requires a crafted bundle to be processed by the vulnerable extraction routine, implying a local or file‑based attack that likely targets users who open malicious archives or operations performed by an untrusted process. Because the problem manifests as a crash rather than privilege escalation or data disclosure, the immediate risk is interruption of service to the affected user or system.