Remote Code Execution in SzafirHost
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputStream parser (reading sequentially from local file headers). An attacker who controls the served archive can insert a malicious DLL/SO/DYLIB as a local-file-header entry between the last legitimate entry and the Central Directory, without adding it to the Central Directory. The signature verifier never sees the injected entry and accepts the archive as validly signed; the extractor reads it sequentially and writes the attacker library to the native temp directory with no hash check), while the archive-size check still passes. This can lead to remote code execution. This issue was fixed in version 1.2.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Krajowa Izba Rozliczeniowa | SzafirHost | before 1.2.2 | 1.2.2 | Patch available | CNA |
- SzafirHost VendorKrajowa Izba Rozliczeniowa Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
Remediation
- Fix · CNA SzafirHost (Krajowa Izba Rozliczeniowa) Fixed in 1.2.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-13165
- 2026-10-03 Alias added: GHSA-r9vj-frg8-hc25
References
More Krajowa Izba Rozliczeniowa vulnerabilities
- TI-2026-07960 Improper Certificate Verification in Szafir SDK CVSS 4.0CRITICAL 9.3
- TI-2026-21415 Lack of Dynamic Library Validation in SzafirHost CVSS 4.0HIGH 8.7
- TI-2026-32104 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
- TI-2026-82552 Szafir accepts unvalidated TLS certificates for update downloads CVSS 4.0MEDIUM 6.9
- TI-2026-82528 XML external entity injection in Szafir and Szafir Weryfikująca CVSS 4.0HIGH 8.2
- TI-2026-21414 URL (HTTP Origin) call location spoofing in Szafir SDK Web CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-13165 · CVE Program
- CVE-2026-13165 · NVD
- FIRST EPSS
- GHSA-r9vj-frg8-hc25 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences