Veille CVE

‹ Retour à la liste

CVE-2026-55780

2.4 Faible

Publiée le 10/07/2026 à 19:16 · Modifiée le 13/07/2026 à 21:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's .NET single-file bundle handler in NanaZip.Codecs.Archive.DotNetSingleFile.cpp sizes its extraction buffer from the bundle entry Size field, which is only checked for sign and is not validated against the real file size. A crafted bundle can cause an attacker-chosen allocation inside Extract, where std::bad_alloc or std::length_error can escape across the COM STDMETHODCALLTYPE boundary and crash the process. This issue is fixed in version 6.5.1749.0.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 2.4 Faible security-advisories@github.com CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Faiblesses (CWE)

Références

Ailleurs