CVE-2026-55780

unknowncovered by 1 sourcefirst seen 2026-07-10

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause an attacker-chosen allocation inside Extract, where std::bad_alloc or std::length_error can escape across the COM STDMETHODCALLTYPE boundary and crash the process. This issue is fixed in version 6.5.1749.0.

⚡ Watch CVE-2026-55780

Get an email if CVE-2026-55780 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-55780: NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.…nvd · 2026-07-10

External references

NVD record for CVE-2026-55780

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55780 status](https://www.csirts.com/badge/CVE-2026-55780)](https://www.csirts.com/cve/CVE-2026-55780)