CyberRota Analysis
AI-GeneratedNanaZip versions prior to 6.5.1749.0 are vulnerable due to improper validation of attacker-controlled buffer allocations in the WebAssembly archive handler, which can lead to memory exhaustion or process termination. This vulnerability poses a risk primarily to users of NanaZip on Windows systems, particularly in environments where untrusted archives may be processed. Organizations using NanaZip should prioritize upgrading to the latest version to mitigate potential disruptions and security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's WebAssembly archive handler in NanaZip.Codecs.Archive.WebAssembly.cpp allocates buffers from attacker-controlled 32-bit section and custom-name length fields without validating them against the data present in the file. A tiny crafted module can force multi-gigabyte allocations during listing or extraction through NameSize, Information.Size, and std::string or vector allocation paths, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.