CVE-2026-55781

Name of the Vulnerable Software and Affected Versions NanaZip versions prior to 6.5.1749.0

Description The UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and fails to validate the fs fsize fragment size. This allows attacker-controlled 32-bit fields to influence indirect-block, directory, and extraction buffer allocations. Consequently, a specially crafted UFS image can trigger multi-gigabyte memory allocations during the opening or extraction process, leading to memory exhaustion or process termination.

Recommendations Update to version 6.5.1749.0.