Denial-of-Service Vulnerability in NanaZip File Archive by M2Team

CVE-2026-27710

What is CVE-2026-27710?

NanaZip, an open-source file archiving tool, is prone to a denial-of-service vulnerability due to flawed handling in its .NET Single File Application parser. This flaw, present from version 5.0.1252.0 up to versions 6.0.1638.0 and 6.5.1638.0, can be exploited by providing a specially crafted archive bundle. This can lead to an integer underflow scenario during header-size calculations, prompting unbounded memory allocation attempts when attempting to open the archive. Versions 6.0.1638.0 and 6.5.1638.0 have addressed and sorted out this issue, reinforcing the importance of timely updates.

References