CVE-2026-55780— NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
Possible ATT&CK Techniques 1AI
T1203 · Exploitation for Client ExecutionGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55780
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
Source: NVD (National Vulnerability Database)
Vulnerability Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause an attacker-chosen allocation inside Extract, where std::bad_alloc or std::length_error can escape across the COM STDMETHODCALLTYPE boundary and crash the process. This issue is fixed in version 6.5.1749.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
未捕获的异常
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-55780
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55780
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55780 (1)
Vendor Advisories for CVE-2026-55780 (1)
Vendor Pages for CVE-2026-55780 (1)
Same Patch Batch · M2Team · 2026-07-10 · 4 CVEs total
| CVE-2026-55783 | NanaZip: NULL pointer dereference in Extract() of all seven NanaZip custom archive handler | |
| CVE-2026-55782 | NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-cont | |
| CVE-2026-55781 | NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/ |
IV. Related Vulnerabilities
Same product: NanaZip
- CVE-2026-55781
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS pa - CVE-2026-55783
NanaZip: NULL pointer dereference in Extract() of all seven - CVE-2026-55782
NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAss - CVE-2026-47223
NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree des - CVE-2026-47224
NanaZip: Heap buffer-overflow read in NanaZip LVM metadata C
Same vendor: M2Team
- CVE-2026-55781
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS pa - CVE-2026-55783
NanaZip: NULL pointer dereference in Extract() of all seven - CVE-2026-55782
NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAss - CVE-2026-47223
NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree des - CVE-2026-47224
NanaZip: Heap buffer-overflow read in NanaZip LVM metadata C
Same weakness: CWE-248
- CVE-2026-59162
Excelize: Negative shared-string index causes panic in GetCe - CVE-2026-54775
CoreWCF: Kafka consume pump halts permanently on a Kafka tom - CVE-2026-58208
NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-On - CVE-2026-59892
OpenTelemetry JavaScript: Denial of service in `JaegerPropag - CVE-2026-59875
node-tar: Uncaught Exception DoS via NUL byte in PAX path/li
V. Comments for CVE-2026-55780
No comments yet