CyberRota Analysis
AI-GeneratedNanaZip versions prior to 6.5.1749.0 contain a vulnerability in their IInArchive handlers that allows for a NULL pointer dereference when processing certain archive types, leading to application crashes. This issue primarily affects users of NanaZip on Windows who utilize the affected archive formats, and it is crucial for them to upgrade to the patched version to ensure stability and prevent potential disruptions. Organizations relying on NanaZip for archive management should prioritize this update to maintain operational integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs unconditionally dereference the caller-supplied Indices array inside Extract when the archive engine signals extract everything by passing Indices as NULL and NumItems as 0xFFFFFFFF. This causes a NULL pointer dereference in the standard Test archive or Extract all code path for WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archives, resulting in a process crash. This issue is fixed in version 6.5.1749.0.