CVE-2026-55782: NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NanaZipto a version that resolves this vulnerability.Fixed in 6.5.1749.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55782?
The severity of CVE-2026-55782 is classified as low with a CVSS score of 4.0.
What type of vulnerability is CVE-2026-55782?
CVE-2026-55782 is an unbounded memory allocation vulnerability that can lead to a denial of service (DoS).
How do I fix CVE-2026-55782?
To fix CVE-2026-55782, update NanaZip to version 6.5.1749.0 or later.
What can be exploited in CVE-2026-55782?
CVE-2026-55782 can be exploited through attacker-controlled section and custom-name length fields in the WebAssembly parser of NanaZip.
Which software is affected by CVE-2026-55782?
NanaZip versions prior to 6.5.1749.0 are affected by CVE-2026-55782.