CVE-2026-55782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55782", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T14:40:28.379Z", "datePublished": "2026-07-10T16:46:38.842Z", "dateUpdated": "2026-07-14T02:00:57.604Z"}, "containers": {"cna": {"title": "NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m"}, {"name": "https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2", "tags": ["x_refsource_MISC"], "url": "https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2"}, {"name": "https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae", "tags": ["x_refsource_MISC"], "url": "https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae"}, {"name": "https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6", "tags": ["x_refsource_MISC"], "url": "https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6"}, {"name": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0"}], "affected": [{"vendor": "M2Team", "product": "NanaZip", "versions": [{"version": "< 6.5.1749.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T16:46:38.842Z"}, "descriptions": [{"lang": "en", "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0."}], "source": {"advisory": "GHSA-qxhc-2v6p-wm8m", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T02:00:08.437231Z", "id": "CVE-2026-55782", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T02:00:57.604Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55782", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T02:00:08.437231Z"}}}], "references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T02:00:39.317Z"}}], "cna": {"title": "NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields", "source": {"advisory": "GHSA-qxhc-2v6p-wm8m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.4, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "M2Team", "product": "NanaZip", "versions": [{"status": "affected", "version": "< 6.5.1749.0"}]}], "references": [{"url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m", "name": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2", "name": "https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae", "name": "https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6", "name": "https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0", "name": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T16:46:38.842Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55782", "state": "PUBLISHED", "dateUpdated": "2026-07-14T02:00:57.604Z", "dateReserved": "2026-06-17T14:40:28.379Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T16:46:38.842Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "NanaZip", "vendor": "M2Team", "versions": [{"status": "affected", "version": "< 6.5.1749.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0."}, {"lang": "es", "value": "NanaZip es el derivado de 7-Zip dise\u00f1ado para la experiencia moderna de Windows. Antes de la versi\u00f3n 6.5.1749.0, el gestor de archivos WebAssembly de NanaZip en NanaZip.Codecs.Archive.WebAssembly.cpp asigna b\u00faferes de una secci\u00f3n de 32 bits controlada por el atacante y campos de longitud de nombre personalizados sin validarlos contra los datos presentes en el archivo. Un m\u00f3dulo peque\u00f1o y malintencionado puede forzar asignaciones de varios gigabytes durante la enumeraci\u00f3n o extracci\u00f3n a trav\u00e9s de las rutas de asignaci\u00f3n de NameSize, Information.Size y std::string o vector, causando agotamiento de memoria o terminaci\u00f3n del proceso. Este problema se solucion\u00f3 en la versi\u00f3n 6.5.1749.0."}], "id": "CVE-2026-55782", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55782", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T02:00:08.437231Z", "version": "2.0.3"}}]}, "published": "2026-07-10T17:17:00.017", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/M2Team/NanaZip/commit/1ce90f2d14a984476d0407a835273705607facf2"}, {"source": "security-advisories@github.com", "url": "https://github.com/M2Team/NanaZip/commit/56aee89037947410dd5e66f3a087e0f290484bae"}, {"source": "security-advisories@github.com", "url": "https://github.com/M2Team/NanaZip/commit/92b12a6e1eb0cf8e88fcc277aa7508ca1ff27db6"}, {"source": "security-advisories@github.com", "url": "https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc-2v6p-wm8m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.5.1749.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "NanaZip", "source": "cna", "vendor": "M2Team"}, "product": "nanazip", "vendor": "m2team"}], "created": "2026-07-10T18:30:16.429355+00:00", "updated": "2026-08-01T12:45:03.449840+00:00", "vendors": ["m2team", "m2team$PRODUCT$nanazip"]}