Executive brief
BandiZip is a popular file compression and extraction utility. A vulnerability in version 7.37 and earlier allows malicious files to bypass Windows "Mark-of-the-Web" security warnings when extracted from a downloaded archive. If a user extracts and runs a malicious script from such an archive, the operating system may fail to block the execution or warn the user, potentially leading to a full system compromise.
Technical details
A Protection Mechanism Failure (CWE-693) exists in BandiZip v7.37 and earlier. The application fails to propagate the Zone.Identifier NTFS Alternate Data Stream (ADS), commonly known as Mark-of-the-Web (MoTW), to extracted Windows Script Files (.wsf). An attacker can exploit this by tricking a user into downloading a crafted archive and executing the contained script. Because the MoTW is missing, Windows SmartScreen and other security features may fail to trigger the standard "file downloaded from the internet" warnings, allowing arbitrary code execution in the context of the current user. This issue was addressed in version 7.38.
Affected products
- Bandisoft BandiZip 7.37 and earlier
Timeline
- 2025-02-11: patched: Initial fix for MoTW processing in v7.37; further MoTW fixes in v7.38 and v7.40.
- 2026-07-22: disclosed: CVE-2025-50325 published.