CVE-2026-27710 is an integer underflow vulnerability classified under CWE-191 found in the NanaZip file archiver software, specifically in its .NET Single File Application parser component. The vulnerability arises when processing a maliciously crafted archive bundle that manipulates the header-size calculation. During this calculation, an integer underflow occurs, causing the software to compute an incorrect, excessively large size for memory allocation. This leads to an unbounded memory allocation attempt which can exhaust system resources or cause the application to crash, resulting in a denial-of-service (DoS) condition. The affected versions include NanaZip releases starting from 5.0.1252.0 up to versions prior to 6.0.1638.0 and 6.5.1638.0. The vulnerability requires the user to open a specially crafted archive file, implying user interaction is necessary, and the attacker must have at least limited privileges on the system (local access). The CVSS 4.0 base score is 5.1, reflecting medium severity due to the limited attack vector (local) and required user interaction, but with high impact on availability. No known public exploits or active exploitation campaigns have been reported to date. The issue is resolved in NanaZip versions 6.0.1638.0 and 6.5.1638.0, which include fixes to prevent the integer underflow and properly validate header sizes before memory allocation.

The primary impact of this vulnerability is denial of service, where an attacker can cause the NanaZip application to crash or become unresponsive by supplying a malicious archive file. This can disrupt workflows that rely on NanaZip for file compression and decompression, potentially affecting backup processes, file transfers, or automated archival tasks. While the vulnerability does not directly lead to code execution or data corruption, the resulting application instability can cause operational disruptions. Organizations with users who frequently handle archive files using NanaZip are at risk of service interruptions. Since exploitation requires local access and user interaction, remote exploitation is unlikely, limiting the scope somewhat. However, in environments where NanaZip is used extensively, such as software development, IT operations, or digital forensics, the disruption could be significant. No evidence suggests data confidentiality or integrity is compromised by this vulnerability.

To mitigate this vulnerability, organizations should upgrade NanaZip to versions 6.0.1638.0 or later, where the integer underflow issue is fixed. Until upgrades are applied, users should avoid opening archive files from untrusted or unknown sources to reduce the risk of triggering the vulnerability. Implement application whitelisting and endpoint protection to detect and block suspicious archive files. Educate users about the risks of opening files from unverified origins. Additionally, monitor systems for abnormal application crashes or high memory usage related to NanaZip processes, which could indicate attempted exploitation. If upgrading immediately is not feasible, consider restricting NanaZip usage to trusted personnel or sandboxing the application to limit impact. Regularly review and apply vendor patches and security advisories to maintain protection against emerging threats.