Executive brief
SzafirHost, a component used for digital signature services, contains a vulnerability in how it handles downloaded software libraries. An attacker who can trick a user into downloading a specially crafted archive can bypass security checks to install malicious code on the user's computer. This could allow an attacker to take full control of the affected system, potentially compromising sensitive digital signing keys or corporate data.
Technical details
A signature bypass vulnerability exists in SzafirHost due to inconsistent JAR parsing. The application uses a JarFile parser (which reads the Central Directory) for signature verification, but uses a JarInputStream parser (which reads local file headers sequentially) for extraction. An attacker can craft a malicious archive containing a hidden DLL, SO, or DYLIB file located between the last legitimate entry and the Central Directory. Because the verifier only checks entries listed in the Central Directory, it ignores the malicious payload, while the sequential extractor writes the unauthorized library to a temporary directory. This leads to remote code execution when the application subsequently loads the injected native library. The issue is fixed in version 1.2.2.
Affected products
- Krajowa Izba Rozliczeniowa (KIR) SzafirHost < 1.2.2
Timeline
- 2026-06-29: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-29: advisory: NVD record published
- 2026-06-29: patched: Fix confirmed available in version 1.2.2