The vulnerability in B1 Free Archiver v1.5.86 arises because the software fails to propagate the Zone.Identifier alternate data stream when extracting files from archives downloaded from the internet. The Zone.Identifier stream is used by Windows to mark files as originating from an untrusted source, triggering security prompts such as SmartScreen warnings. Without this marker, extracted files can be executed without these protections, increasing the risk of untrusted code execution. No CVSS score or official remediation level is provided, and no patch links are available. The vulnerability is specific to the handling of MotW metadata during extraction.

Files extracted from internet-downloaded archives using the vulnerable B1 Free Archiver version can execute without Windows security prompts or SmartScreen warnings. This reduces the effectiveness of Windows' built-in protections against untrusted or potentially malicious files, potentially allowing untrusted code to run with fewer user warnings. There is no indication of remote code execution or privilege escalation beyond bypassing MotW protections. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when extracting archives downloaded from the internet using B1 Free Archiver v1.5.86. Consider using alternative extraction tools that correctly preserve the Zone.Identifier stream or manually verify the origin and safety of extracted files before execution.