CVE-2026-13165 Remote Code Execution in SzafirHost
Attackers can inject malicious native libraries into signed archives, bypassing signature verification to achieve remote code execution on SzafirHost clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-13165?
CVE-2026-13165 is a high-severity vulnerability in Krajowa Izba Rozliczeniowa SzafirHost, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputStream parser (reading sequentially from local file headers). An attacker who controls the served archive can insert a malicious DLL/SO/DYLIB as a local-file-header entry between the last legitimate entry and the Central Directory, without adding it to the Central Directory. The signature verifier never sees the injected entry and accepts the archive as validly signed; the extractor reads it sequentially and writes the attacker library to the native temp directory with no hash check), while the archive-size check still passes. This can lead to remote code execution.
This issue was fixed in version 1.2.2.
Weakness: CWE-434
Which versions are affected by CVE-2026-13165?
How do I fix CVE-2026-13165?
No fix has been published for CVE-2026-13165 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13165 being exploited?
There is no known exploitation of CVE-2026-13165 in the wild and no public exploit code.
Sources
Also known as GHSA-r9vj-frg8-hc25.