CVE-2026-27710

Executive Summary

CVE-2026-27710 is a denial-of-service vulnerability in NanaZip, an open-source file archiver. The flaw resides in the .NET Single File Application parser, where a crafted bundle can cause an integer underflow during header-size calculation. This underflow leads to an unbounded memory allocation attempt when opening the archive, resulting in a denial-of-service condition. The vulnerability affects versions starting from 5.0.1252.0 up to, but not including, 6.0.1638.0 and 6.5.1638.0. The vendor has released patches in versions 6.0.1638.0 and 6.5.1638.0. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

NanaZip is distributed as a standalone application and is not typically integrated into package registries like NPM, PyPI, Go, or Ruby. However, users who download NanaZip from unofficial or third-party mirrors may be at risk of receiving a vulnerable version. It is critical to obtain the software only from the official GitHub repository or trusted distribution channels.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Local (L) – The attacker must provide a crafted file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must open the malicious archive.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Service becomes unavailable.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Estimated Base Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability requires user interaction and only impacts availability, but it can be triggered by a simple file download.

Deep Dive & Mechanics

The vulnerability is an integer underflow (CWE-191) in the .NET Single File Application parser within NanaZip. When parsing a crafted bundle, the code calculates the header size using a subtraction operation. If the crafted input causes the minuend to be smaller than the subtrahend, the result wraps around to a very large positive integer (due to unsigned integer behavior). This large value is then used as the size for a memory allocation, leading to an attempt to allocate an unbounded amount of memory. This can exhaust system resources, causing the application to crash or become unresponsive.

The vulnerable code path is triggered during the archive open operation, specifically when NanaZip attempts to parse the header of a .NET Single File Application bundle. The parser does not properly validate the arithmetic operation, allowing an attacker to craft a file that triggers the underflow.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the fix likely involves adding bounds checking before the header-size calculation. A conceptual example:

Vulnerable Code (pseudocode):

uint32_t header_size = total_size - offset;
// No check for underflow
uint8_t* header = malloc(header_size);

Patched Code (pseudocode):

if (offset > total_size) {
    // Handle error
    return ERROR_INVALID_DATA;
}
uint32_t header_size = total_size - offset;
if (header_size > MAX_HEADER_SIZE) {
    // Handle error
    return ERROR_INVALID_DATA;
}
uint8_t* header = malloc(header_size);

The patch ensures that the subtraction does not underflow and that the resulting size is within acceptable limits.

Exploitation & Lab Setup

Red Team

No public exploit code is available. To develop a proof-of-concept, an attacker would need to:

1. Analyze the .NET Single File Application bundle format.
2. Craft a file where the header-size calculation results in an integer underflow.
3. Deliver the file to the victim (e.g., via email, download link).
4. When the victim opens the file with a vulnerable version of NanaZip, the application will attempt to allocate an excessive amount of memory, causing a denial of service.

Lab Setup:

• Install a vulnerable version of NanaZip (e.g., 5.0.1252.0) on a test machine.
• Create a malicious .NET Single File Application bundle using a hex editor or custom script.
• Open the file with NanaZip and observe the crash or memory exhaustion.

Blue Team

Detection:

• Monitor for unusual memory allocation patterns by NanaZip.exe.
• Use file integrity monitoring to detect the presence of crafted .NET Single File Application bundles.
• Deploy endpoint detection and response (EDR) rules to alert on NanaZip crashes.

Hunting:

• Search for NanaZip processes that consume excessive memory.
• Look for files with unusual header structures that match the .NET Single File Application format.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes available.
• File Names: Any .exe or .dll file that is a .NET Single File Application bundle.
• Process Behavior: NanaZip.exe attempting to allocate > 2GB of memory.
• Network: No network indicators.
• Registry: No registry indicators.

Detection Engineering

YARA Rule

rule CVE_2026_27710_NanaZip_DOS {
    meta:
        description = "Detects crafted .NET Single File Application bundles targeting CVE-2026-27710"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-27710"
    strings:
        $magic = { 4D 5A } // MZ header
        $net_header = { 2E 4E 45 54 } // .NET
        $suspicious_size = { FF FF FF FF } // Potential underflow trigger
    condition:
        $magic at 0 and $net_header and #suspicious_size > 0
}

Sigma Rule

title: NanaZip Denial of Service via Crafted .NET Bundle
id: 8a7b3c2d-1e5f-4a6b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects NanaZip process attempting to allocate excessive memory, indicative of CVE-2026-27710 exploitation.
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27710
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\NanaZip.exe'
        CommandLine|contains: '*.exe'  # Opening a file
    condition: selection
    timeframe: 5m
    falsepositives:
        - Legitimate large archives
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-27710 NanaZip DOS Attempt"; flow:to_server,established; content:"|4d 5a|"; offset:0; depth:2; content:".NET"; within:100; content:"|ff ff ff ff|"; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Update NanaZip: Upgrade to version 6.0.1638.0 or 6.5.1638.0 immediately.
2. User Awareness: Educate users not to open .NET Single File Application bundles from untrusted sources.
3. Application Control: Use application whitelisting to prevent execution of untrusted binaries.
4. Memory Limits: Configure system or application-level memory limits to mitigate the impact of unbounded allocation.
5. Monitor: Implement the detection rules provided above to identify potential exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence