EUVD-2026-40078
GHSA-r9vj-frg8-hc25
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered but requires attacker-controlled archive source and victim action, so AC:H and UI:R; unauthenticated on target (PR:N) with full host RCE giving C/I/A:H.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputStream parser (reading sequentially from local file headers). An attacker who controls the served archive can insert a malicious DLL/SO/DYLIB as a local-file-header entry between the last legitimate entry and the Central Directory, without adding it to the Central Directory. The signature verifier never sees the injected entry and accepts the archive as validly signed; the extractor reads it sequentially and writes the attacker library to the native temp directory with no hash check), while the archive-size check still passes. This can lead to remote code execution.
This issue was fixed in version 1.2.2.
AnalysisAI
Remote code execution in SzafirHost (KIR's Szafir electronic-signature host application) arises from a ZIP/JAR parser-confusion flaw: signature verification reads the archive's Central Directory while extraction reads local file headers sequentially, letting an attacker who controls the served native-library archive smuggle an unsigned malicious DLL/SO/DYLIB past the signature check. Versions prior to 1.2.2 are affected; the injected library is written to the native temp directory and loaded, yielding code execution on the victim's machine. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
SzafirHost is a host/helper application from Krajowa Izba Rozliczeniowa (KIR) used in Poland's qualified electronic-signature ecosystem (elektronicznypodpis.pl), and it loads platform-native libraries (DLL on Windows, SO on Linux, DYLIB on macOS) delivered inside a signed JAR/ZIP archive. The root cause is a classic ZIP parser differential: the JarFile API authenticates entries by walking the Central Directory at the end of the archive, whereas JarInputStream streams entries from their local file headers at the front. Because the ZIP format permits local-file-header entries that are not referenced in the Central Directory, a file present to JarInputStream can be invisible to JarFile's signature validation. CWE-434 (Unrestricted Upload of File with Dangerous Type) captures the consequence - an unverified executable native library is staged and loaded - though the underlying mechanism is a signature-verification bypass driven by inconsistent ZIP parsing, with the archive-size check insufficient to detect the appended entry.
RemediationAI
Vendor-released patch: 1.2.2 - upgrade SzafirHost to version 1.2.2 or later, which corrects the parser inconsistency so signature verification and extraction operate on the same archive view. Until upgraded, ensure native-library archives are retrieved only over authenticated TLS channels from KIR's legitimate endpoints to reduce the chance of an attacker substituting the served archive, and restrict or monitor write access to the native temp directory where libraries are staged; note these are partial compensating controls that do not close the parsing differential itself and may not prevent a compromised-server scenario. Refer to the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-13165 for authoritative guidance.
More in Szafirhost
View allShare
External POC / Exploit Code
Leaving vuln.today