CVE-2026-55781

NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields

Published Jul 10, 2026 CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fs_fsize fragment size, allowing attacker-controlled 32-bit fields to flow into indirect-block, directory, and extraction buffer allocations. A tiny crafted UFS image can force multi-gigabyte allocations during open or extraction, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.

Analysis

Technical impact

NanaZip's UFS and FFS image handler performs insufficient validation of the superblock block size (fs_bsize) and ignores the fragment size (fs_fsize). A malicious 32‑bit value in a crafted UFS image can cause the program to allocate indirect‑block, directory, or extraction buffers of multi‑gigabyte size, leading to memory exhaustion or process termination. This vulnerability results in a denial‑of‑service condition without compromising data confidentiality or integrity.

Affected Systems

Users of the M2Team NanaZip application running any release earlier than version 6.5.1749.0 are affected. The flaw resides in the NanaZip.Codecs.Archive.Ufs component used for opening or extracting UFS or FFS images.

Risk and Exploitability

The CVSS score of 2.4 indicates low severity, and the EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, further reducing the likelihood of widespread attacks. An adversary can trigger the issue by providing a maliciously crafted UFS image to the application; the attack requires the ability to influence a file NanaZip processes.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

M2Team

NanaZip

affected

Version	Status	Constraints
`< 6.5.1749.0`	affected	—

No data.

Vendor Product Versions

M2team

Nanazip

Version	Status	Scheme	Platform
`[0,6.5.1749.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to NanaZip version 6.5.1749.0 or newer to apply the superblock validation fix.
If an upgrade cannot be performed immediately, disable the UFS/FFS extraction feature or restrict its use to trusted local files to prevent large allocations.
Monitor system memory usage and application stability during UFS operations, and set alerts for unusually large allocations to detect exploitation attempts.

Generated by OpenCVE AI on August 1, 2026 at 12:29 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.159% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/M2Team/NanaZip/commit/6415b6bff70bc9c486b49cbbc1982724c67f8338
https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0
https://github.com/M2Team/NanaZip/security/advisories/GHSA-m34h-jf84-m74h

History

Jul 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 10, 2026 6:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		M2team M2team nanazip
Vendors & Products		M2team M2team nanazip

Jul 10, 2026 5:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fs_fsize fragment size, allowing attacker-controlled 32-bit fields to flow into indirect-block, directory, and extraction buffer allocations. A tiny crafted UFS image can force multi-gigabyte allocations during open or extraction, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.
Title		NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
Weaknesses		CWE-400 CWE-789
References		https://github.com/M2Team/NanaZip/commit/6415b6bff70bc9c486b49cbbc1982724c67f8338 https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0 https://github.com/M2Team/NanaZip/security/advisories/GHSA-m34h-jf84-m74h
Metrics		cvssV4_0 `{'score': 2.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`