CVE-2026-55782 NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields

🗓️ 10 Jul 2026 16:46:38Reported by GoogleType

osv🔗 osv.dev👁 2 Views

NanaZip before 6.5.1749.0 allocates unbounded memory from attacker controlled section and name length in WebAssembly parsing, causing DoS.

Reporter	Title	Published	Views	Family All 8
attackerkb	CVE-2026-55782	10 Jul 202616:46	–	attackerkb
circl	CVE-2026-55782	10 Jul 202623:11	–	circl
cve	CVE-2026-55782	10 Jul 202616:46	–	cve
cvelist	CVE-2026-55782 NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields	10 Jul 202616:46	–	cvelist
euvd	EUVD-2026-42954	10 Jul 202616:46	–	euvd
nvd	CVE-2026-55782	10 Jul 202617:17	–	nvd
ptsecurity	PT-2026-57237	10 Jul 202600:00	–	ptsecurity
vulnrichment	CVE-2026-55782 NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields	10 Jul 202616:46	–	vulnrichment

Source	Link
github	www.github.com/M2Team/NanaZip/releases/tag/6.5.1749.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55782.json
github	www.github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55782
github	www.github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2
github	www.github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae
github	www.github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6

16 Jul 2026 03:31Current

6.1Medium risk

Vulners AI Score6.1

CVSS 42.4

EPSS0.00113