CVE-2026-55780

Executive Summary

CVE-2026-55780 is a denial-of-service (DoS) vulnerability in NanaZip, a modern Windows archiver derived from 7-Zip. The flaw resides in the .NET single-file bundle handler (NanaZip.Codecs.Archive.DotNetSingleFile.cpp). The extraction buffer size is derived from the bundle entry Size field, which is only checked for sign (negative values) but not validated against the actual file size. A crafted bundle can trigger an attacker-chosen allocation inside the Extract function, causing std::bad_alloc or std::length_error to escape across the COM STDMETHODCALLTYPE boundary, crashing the process. This is a local, user-interaction-required vulnerability with no known public exploit code.

Supply Chain & Package Security

NanaZip is distributed via the Microsoft Store and GitHub releases. The vulnerability affects the .NET single-file bundle handler, which is a core component for extracting .NET single-file applications. Users should update to version 6.5.1749.0 or later. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – requires the attacker to have local access or trick the user into opening a malicious file.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: Required (UI:R) – the victim must open the crafted bundle.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – process crash leads to denial of service.

Threat Level: Medium. The vulnerability is local and requires user interaction, but it can be used to crash NanaZip repeatedly, disrupting archival operations.

Deep Dive & Mechanics

The vulnerability is in the Extract function of NanaZip.Codecs.Archive.DotNetSingleFile.cpp. The .NET single-file bundle format contains entries with a Size field that specifies the size of the embedded file. The code allocates a buffer based on this Size field without validating it against the actual file size in the archive. The only check is for sign (negative values), but a large positive value can cause an integer overflow or excessive allocation.

Root Cause:

• The Size field is read from the bundle entry.
• The code checks if Size < 0 but does not check if Size exceeds the remaining file size or a reasonable limit.
• The buffer is allocated as new uint8_t[Size], which can throw std::bad_alloc if the allocation fails or std::length_error if Size is too large.
• These exceptions are not caught within the COM boundary, causing the process to crash.

Impact:

• An attacker can craft a .NET single-file bundle with a manipulated Size field.
• When NanaZip attempts to extract the bundle, it allocates an enormous buffer, leading to memory exhaustion or an exception.
• The exception escapes the COM interface, crashing the application.

Affected Component:

• NanaZip.Codecs.Archive.DotNetSingleFile.cpp – the handler for .NET single-file bundles.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

HRESULT Extract(IStream* stream, UINT64 size) {
    // Read bundle entry
    BundleEntry entry;
    ReadEntry(stream, entry);
    
    // Only check for negative size
    if (entry.Size < 0) {
        return E_INVALIDARG;
    }
    
    // Allocate buffer based on entry.Size without validation
    uint8_t* buffer = new uint8_t[entry.Size];
    
    // Read data into buffer
    ReadStream(stream, buffer, entry.Size);
    
    // ... extraction logic ...
    
    delete[] buffer;
    return S_OK;
}

Patched Code (simplified):

HRESULT Extract(IStream* stream, UINT64 size) {
    // Read bundle entry
    BundleEntry entry;
    ReadEntry(stream, entry);
    
    // Validate size against actual file size
    if (entry.Size < 0 || entry.Size > size) {
        return E_INVALIDARG;
    }
    
    // Allocate buffer with safe size
    uint8_t* buffer = new uint8_t[entry.Size];
    
    // Read data into buffer
    ReadStream(stream, buffer, entry.Size);
    
    // ... extraction logic ...
    
    delete[] buffer;
    return S_OK;
}

Key Difference: The patched version adds a check entry.Size > size to ensure the requested size does not exceed the actual file size, preventing excessive allocations.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Crash NanaZip by crafting a malicious .NET single-file bundle.

Lab Setup:

1. Environment: Windows 10/11 with NanaZip version < 6.5.1749.0 installed.
2. Tools: Hex editor (e.g., HxD), Python for crafting the bundle.

Steps:

1. Create a valid .NET single-file bundle (e.g., a simple .NET application published as a single file).
2. Locate the bundle entry Size field in the binary.
3. Modify the Size field to a very large value (e.g., 0xFFFFFFFF).
4. Save the modified file.
5. Open the file with NanaZip and attempt to extract it.
6. Observe the crash.

Example Python script to craft the malicious bundle:

import struct

def craft_malicious_bundle(input_file, output_file):
    with open(input_file, 'rb') as f:
        data = f.read()
    
    # Find the bundle entry size field (offset depends on format)
    # For demonstration, assume offset 0x100
    offset = 0x100
    # Overwrite with a large size (e.g., 0x7FFFFFFF)
    new_size = 0x7FFFFFFF
    data = data[:offset] + struct.pack('<I', new_size) + data[offset+4:]
    
    with open(output_file, 'wb') as f:
        f.write(data)

craft_malicious_bundle('valid_bundle.exe', 'malicious_bundle.exe')

Expected Outcome: NanaZip crashes with an unhandled exception.

Blue Team (Defender)

Detection:

• Monitor for crashes of NanaZip.exe or 7zFM.exe (if NanaZip is used).
• Look for event logs indicating std::bad_alloc or std::length_error exceptions.
• Use file integrity monitoring to detect modified .NET single-file bundles.

Mitigation:

• Update NanaZip to version 6.5.1749.0 or later.
• Restrict execution of untrusted .NET single-file bundles.
• Use application whitelisting to prevent NanaZip from opening unknown files.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • malicious_bundle.exe: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names: NanaZip.exe, 7zFM.exe
• Event Logs:
  • Windows Application Event Log: Event ID 1000 (Application Error) with faulting module NanaZip.Codecs.dll.
  • .NET Runtime Event Log: Event ID 1026 with exception type System.BadImageFormatException or System.OutOfMemoryException.
• Network Indicators: None (local vulnerability).
• Registry Keys: None.

Detection Engineering

YARA Rule

rule CVE_2026_55780_NanaZip_DOS {
    meta:
        description = "Detects malicious .NET single-file bundles exploiting CVE-2026-55780"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-55780"
    strings:
        $s1 = ".NET" ascii wide nocase
        $s2 = "Bundle" ascii wide nocase
        $s3 = { FF FF FF 7F } // Large size field (0x7FFFFFFF)
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: NanaZip Crash via Malicious .NET Single-File Bundle
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects crashes of NanaZip due to CVE-2026-55780 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        FaultingModule: "NanaZip.Codecs.dll"
    condition: selection
falsepositives:
    - Legitimate crashes due to memory issues
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-55780 NanaZip Malicious Bundle Download"; flow:to_server,established; content:"|FF FF FF 7F|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update NanaZip to version 6.5.1749.0 or later from the Microsoft Store or GitHub.
2. If update is not possible, avoid opening .NET single-file bundles from untrusted sources.
3. Use application control policies to block NanaZip from executing unknown files.

Long-Term Measures:

• Implement input validation for all size fields in archive handlers.
• Use safe integer arithmetic to prevent overflows.
• Catch exceptions across COM boundaries to prevent crashes.

Workarounds:

• Use an alternative archiver (e.g., 7-Zip) for .NET single-file bundles until patched.

Valters IT