CVE-2026-13165

Name of the Vulnerable Software and Affected Versions SzafirHost versions prior to 1.2.2

Description SzafirHost is susceptible to remote code execution due to a discrepancy between how it verifies and extracts native library archives. The software uses a JarFile parser to verify the archive by reading the Central Directory, but employs a JarInputStream parser to extract libraries by reading sequentially from local file headers. An attacker can inject a malicious DLL, SO, or DYLIB as a local-file-header entry between the last legitimate entry and the Central Directory. Because this injected entry is not present in the Central Directory, the signature verifier accepts the archive as valid, while the extractor writes the malicious library to the native temporary directory without a hash check.

Recommendations Update SzafirHost to version 1.2.2.