Signed SzafirHost Archives Can Hide Unchecked Native Code
SzafirHost can trust a package’s signature and still unpack native code that was never covered by that signature. The break is between verification and extraction: one parser checks the archive index, a different parser reads the stream and writes out an injected DLL, SO, or DYLIB that can lead to remote code execution.
CERT Polska says CVE-2026-13165 was fixed in SzafirHost 1.2.2. The flaw affects downloaded native library archives, where a malicious entry placed outside the Central Directory is invisible to the signature check but still extracted by the unpacker.