CVE-2026-27710
📋 TL;DR
A denial-of-service vulnerability exists in NanaZip's .NET Single File Application parser where a crafted archive bundle can trigger an integer underflow in header-size calculation, leading to unbounded memory allocation attempts. This affects users opening malicious archives with NanaZip versions 5.0.1252.0 through 6.0.1638.0 and 6.5.1638.0.
💻 Affected Systems
- NanaZip
📦 What is this software?
Nanazip by M2team
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or freeze due to excessive memory consumption, potentially requiring hard reboot
Likely Case
Application crash when opening malicious archives, with possible temporary system instability
If Mitigated
Application crash without system-wide impact if memory limits are enforced
🎯 Exploit Status
Exploitation requires user to open a crafted archive; no authentication needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.1638.0 and 6.5.1638.0
Vendor Advisory: https://github.com/M2Team/NanaZip/security/advisories/GHSA-89qw-8p49-32wf
Restart Required: No
Instructions:
1. Download latest version from GitHub releases 2. Install over existing version 3. No restart required
🔧 Temporary Workarounds
Disable .NET Single File Application support
windowsPrevent parsing of vulnerable archive types
Not applicable - configuration change in application
Use alternative archive software
windowsTemporarily use 7-Zip or other archive tools
🧯 If You Can't Patch
- Implement application whitelisting to block NanaZip execution
- Educate users to avoid opening archives from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check NanaZip version in Help > About; if between 5.0.1252.0 and 6.0.1638.0/6.5.1638.0, vulnerableCheck Version:
NanaZip.exe --version or check Help > About in GUIVerify Fix Applied:
Verify version is 6.0.1638.0 or 6.5.1638.0 or higher📡 Detection & Monitoring
Log Indicators:
- Application crash logs with memory allocation failures
- High memory usage spikes from NanaZip process
Network Indicators:
- Downloads of archive files from untrusted sources
SIEM Query:
Process: NanaZip.exe AND (EventID: 1000 OR MemoryUsage > 90%)