NanaZip, a 7‑Zip derivative for modern Windows, contains an unbounded memory allocation flaw in its WebAssembly archive parser. The parser creates internal buffers based on 32‑bit section and custom‑name length values that are controlled by the content of a .wasm file. A malicious module can set NameSize or Information.Size to very large values, forcing NanaZip to try to allocate multi‑gigabyte amounts of memory during file listing or extraction. This leads to memory exhaustion or process termination, a classic denial of service, reflected by CWE‑400 and CWE‑789.

All versions of NanaZip by M2Team that are older than 6.5.1749.0 are affected. The issue was addressed in release 6.5.1749.0. On systems running any earlier version, any file that contains a WebAssembly module with inflated size fields could trigger the vulnerability if the application processes the archive.

The CVSS score of 2.4 indicates a low severity denial of service. The EPSS score of <1% and absence from the CISA KEV catalog suggest a very low probability of exploitation. Attack would require the attacker to supply a specially crafted .wasm file. The vulnerability may be triggered by a local user opening a file or by a remote entity if the application processes untrusted archives over a network. The impact is limited to memory exhaustion or process crash, but attackers could use this to disrupt service availability.