The vulnerability in B1 Free Archiver v1.5.86 involves failure to propagate the 'Zone.Identifier' alternate data stream when extracting files from archives downloaded from the internet. This stream is used by Windows to mark files as originating from an untrusted source, triggering security features such as SmartScreen warnings. Without this marking, extracted files can execute without user prompts or warnings, increasing the risk of executing malicious code. The CVSS score of 7.3 reflects network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability at a low level.

Files extracted using the vulnerable B1 Free Archiver can bypass Windows security mechanisms designed to warn users about potentially unsafe files downloaded from the internet. This can lead to untrusted code execution without triggering Windows Defender SmartScreen or other security prompts, increasing the risk of malware execution and system compromise. The impact affects confidentiality, integrity, and availability at a low level but is significant due to the lack of user warnings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when extracting archives downloaded from the internet using B1 Free Archiver. Consider using alternative extraction tools that correctly propagate the Zone.Identifier stream or manually verify the origin and safety of extracted files before execution.