CVE-2026-55782

Executive Summary

CVE-2026-55782 is a high-severity memory exhaustion vulnerability in NanaZip, a modern Windows derivative of 7-Zip. The flaw resides in the WebAssembly archive handler (NanaZip.Codecs.Archive.WebAssembly.cpp), where the code allocates buffers based on attacker-controlled 32-bit section and custom-name length fields without validating them against the actual data present in the file. A tiny, specially crafted WebAssembly module can force multi-gigabyte allocations during listing or extraction operations, leading to memory exhaustion or process termination. This is a classic denial-of-service (DoS) vulnerability that can be triggered by a user simply attempting to open or extract a malicious archive. The vulnerability is fixed in NanaZip version 6.5.1749.0.

Supply Chain & Package Security

NanaZip is distributed via the Microsoft Store and GitHub. Users who install NanaZip from the Microsoft Store receive automatic updates, but those who manually install from GitHub releases must update manually. The vulnerability does not affect the upstream 7-Zip project, only the NanaZip fork.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

• Attack Vector (AV): Local (AV:L) – The attacker must provide a malicious file to the victim.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – The victim must open the malicious archive.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Memory exhaustion leads to denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can cause system instability or crash.

Deep Dive & Mechanics

The vulnerability is in the WebAssembly archive handler. When NanaZip processes a .wasm file, it reads 32-bit fields from the file header to determine buffer sizes for section data and custom names. The code does not validate these sizes against the actual file size. An attacker can craft a tiny .wasm file (e.g., 1KB) that declares a section size of 4GB. When NanaZip attempts to allocate a buffer of that size, the system runs out of memory, causing a crash or hang.

The vulnerable code path is in NanaZip.Codecs.Archive.WebAssembly.cpp. The handler reads NameSize and Information.Size fields and uses them to allocate std::string or std::vector buffers. Without validation, these allocations can be arbitrarily large.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// Vulnerable: No size validation
uint32_t nameSize = ReadUint32(file);
std::string name(nameSize, '\0'); // Allocates nameSize bytes
file.Read(&name[0], nameSize);

Patched Code (simplified):

// Patched: Validate against remaining file size
uint32_t nameSize = ReadUint32(file);
if (nameSize > file.RemainingSize()) {
    return E_FAIL; // Reject the file
}
std::string name(nameSize, '\0');
file.Read(&name[0], nameSize);

The patch adds a check that the declared size does not exceed the remaining data in the file. This prevents the allocation of buffers larger than the file itself.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Cause denial of service on a target system running NanaZip.

Steps:

1. Create a minimal WebAssembly module with a crafted header.
2. Set the section size or custom name length to a large value (e.g., 0xFFFFFFFF).
3. Deliver the file to the victim (e.g., via email, download link).
4. When the victim opens the file with NanaZip, the application will attempt to allocate a huge buffer, exhausting memory and crashing.

Example Crafted File (Hex):

00 61 73 6D 01 00 00 00  ; WASM magic + version
01 00 00 00              ; Section count = 1
00 00 00 00              ; Section ID (custom)
FF FF FF FF              ; Section size = 4GB (malicious)

Note: No public exploit code is available at this time.

Blue Team (Defender)

Detection:

• Monitor for NanaZip processes consuming excessive memory.
• Use file scanning to detect WebAssembly files with abnormally large declared sizes.
• Implement behavioral detection for memory allocation spikes.

Prevention:

• Update NanaZip to version 6.5.1749.0 or later.
• Use application whitelisting to block untrusted .wasm files.
• Deploy memory limit controls (e.g., Windows Job Objects) to cap NanaZip memory usage.

Indicators of Compromise (IOCs)

• File Hashes: (None publicly known, but any .wasm file with a section size > file size is suspicious)
• Process Behavior: NanaZip.exe attempting to allocate >2GB of memory.
• Network: No network indicators (local file-based attack).
• Registry: No registry changes.

Detection Engineering

YARA Rule

rule CVE_2026_55782_NanaZip_Wasm_DoS {
    meta:
        description = "Detects malicious WebAssembly files exploiting CVE-2026-55782"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $wasm_magic = { 00 61 73 6D }
        $large_size = { FF FF FF FF }
    condition:
        $wasm_magic at 0 and $large_size
}

Sigma Rule

title: NanaZip Memory Exhaustion via Malicious WebAssembly
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects NanaZip process attempting to allocate excessive memory
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\NanaZip.exe'
        CommandLine|contains: '.wasm'
    condition: selection
falsepositives:
    - Legitimate large WebAssembly files (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-55782 NanaZip WebAssembly DoS Attempt"; flow:to_server; content:"|00 61 73 6D|"; offset:0; depth:4; content:"|FF FF FF FF|"; within:20; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update NanaZip to version 6.5.1749.0 or later from the Microsoft Store or GitHub.
• If update is not possible, avoid opening untrusted .wasm files.

Long-term:

• Implement input validation for all archive handlers.
• Use memory-safe allocation practices (e.g., check allocation size against file size).
• Conduct regular security audits of file parsing code.

Workaround:

• Use alternative archive tools (e.g., 7-Zip) for WebAssembly files until patched.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert