CVE-2026-27710: NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)
NanaZip is an open source file archive. Starting in version 5.0.1252.0 and prior to versions 6.0.1638.0 and 6.5.1638.0, a denial-of-service vulnerability exists in NanaZip’s .NET Single File Application parser. A crafted bundle can force an integer underflow in header-size calculation and trigger an unbounded memory allocation attempt during archive open. Versions 6.0.1638.0 and 6.5.1638.0 fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27710?
CVE-2026-27710 is classified as a denial-of-service (DoS) vulnerability caused by an integer underflow in the .NET Single-File Parser of NanaZip.
How do I fix CVE-2026-27710?
To mitigate CVE-2026-27710, upgrade NanaZip to version 6.0.1638.0 or later.
What versions of NanaZip are affected by CVE-2026-27710?
CVE-2026-27710 affects NanaZip versions from 5.0.1252.0 up to but not including 6.0.1638.0.
Can CVE-2026-27710 be exploited remotely?
Yes, CVE-2026-27710 can potentially be exploited remotely, leading to a denial of service.
What impact does CVE-2026-27710 have on system performance?
The impact of CVE-2026-27710 on system performance is a denial-of-service condition that can disrupt the functioning of applications using NanaZip.