CVE-2026-55780

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause an attacker-chosen allocation inside Extract, where std::bad_alloc or std::length_error can escape across the COM STDMETHODCALLTYPE boundary and crash the process. This issue is fixed in version 6.5.1749.0.

• CWE-248
• CWE-400

• https://github.com/M2Team/NanaZip/commit/ad62e3b4970b9f01e924c99094d6fed7a42f849a
• https://github.com/M2Team/NanaZip/releases/tag/6.5.1749.0
• https://github.com/M2Team/NanaZip/security/advisories/GHSA-ppm9-5267-rq72
• https://github.com/M2Team/NanaZip/security/advisories/GHSA-ppm9-5267-rq72

Published

Jul 10, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55775OpenBao is an open source identity-based secrets management …2.3
• CVE-2026-55776OpenBao is an open source identity-based secrets management …6.5
• CVE-2026-55777GoAccess is a real-time web log analyzer and interactive vie…5.3
• CVE-2026-55778Parse Server is an open source backend that can be deployed …2.1
• CVE-2026-55779Silverstripe Versioned provides versioning for Silverstripe …5.4
• CVE-2026-5578A vulnerability was found in CodeAstro Online Classroom 1.0.…6.3
• CVE-2026-55781NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55782NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55783NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55784free5GC is an open-source implementation of the 5G core netw…7.5
• CVE-2026-55785free5GC is an open-source implementation of the 5G core netw…3.7
• CVE-2026-55789Logto is the modern, open-source auth infrastructure for Saa…8.5