NanaZip, a 7‑Zip derivative for Windows, contains a flaw in its custom archive handlers; when the extractor receives a NULL Indices array and a special NumItems value to request extraction of all files, the code unconditionally dereferences the pointer, causing a NULL pointer dereference. The fault is present in all seven in‑house handlers—WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile—resulting in a crash during extraction or archive testing. The manifestation is a process termination that denies service to the application but does not allow code execution or data theft.

All installations of M2Team NanaZip versions earlier than 6.5.1749.0 are affected. Users who operate the bundled archive handlers for WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, or DotNetSingleFile may experience a crash when an untrusted archive is opened or processed. This issue is specific to the extraction or testing of a full archive; processing a subset of files does not trigger the fault.

The CVSS score is 2.4, reflecting a low‑severity denial‑of‑service impact. The EPSS score of less than 1% indicates an extremely low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote delivery of a crafted archive that requests extraction of all files; an attacker cannot gain code execution or alter data, only cause an application crash. Given the low score and minimal exploitability, the risk is considered low, but the flaw can be triggered by any user with access to the application.