CVE-2026-55781CWE-400CWE-789

NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields

Low · published July 10, 2026

CVSS v4.0
2.4
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fs_fsize fragment size, allowing attacker-controlled 32-bit fields to flow into indirect-block, directory, and extraction buffer allocations. A tiny crafted UFS image can force multi-gigabyte allocations during open or extraction, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.

The record
Technical detail
CVSS v4.0
2.4 · LOW
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00159 · 4.7th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-07-10T16:50Z
EPSS history
Timeline
  • 10 JUL 16:50Z
    NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
    cvelistv5