Critical DoS Vulnerability (CVE‑2026‑55780) in NanaZip 6.5 Allows Unbounded Allocation on Windows
What Happened — A crafted .NET single‑file bundle triggers an uncaught exception and an unbounded memory allocation in NanaZip ≤ 6.5 Preview (6.5.1742.0). The flaw (CVE‑2026‑55780) results in a denial‑of‑service condition when the vulnerable Extract() routine processes the malicious file. The issue is fixed in version 6.5.1749.0.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (System Operations) requires documented controls that prevent service‑disruption risks from third‑party software.
- Continuous‑compliance programs must maintain an up‑to‑date inventory of external components and evidence of timely patching.
- Our Control Mapping capability helps you map this vulnerability to the relevant SOC 2 controls and generate audit‑ready evidence of remediation.
Who Is Affected — Organizations that deploy NanaZip for file compression or archival on Windows workstations, including software development teams, IT operations, and any enterprise that bundles the tool into internal tooling pipelines.
Recommended Actions
- Inventory all endpoints for NanaZip ≤ 6.5.1742.0.
- Upgrade immediately to 6.5.1749.0 or later.
- Record the upgrade in your configuration‑management database (CMDB) and attach the vendor patch note as audit evidence.
- Update your SOC 2 control mapping to reflect the remediation of CC6.1 and CC7.1 (Change Management).
Technical Notes – The exploit leverages a malformed .NET single‑file bundle that sets Entry.Size = INT64_MAX, causing std::vector(Size) to allocate beyond available memory and throw across the COM boundary. No remote code execution is observed, but the allocation failure crashes the process, leading to a denial of service. Source: Exploit‑DB 52652