The vulnerability in SzafirHost arises from inconsistent parsing methods during archive verification and extraction. The signature verification relies on the Central Directory entries, while extraction reads local file headers sequentially. An attacker controlling the served archive can inject a malicious native library (DLL/SO/DYLIB) as a local-file-header entry that is not present in the Central Directory. This entry bypasses signature verification but is extracted and written to the native temp directory without integrity checks, enabling remote code execution. The vulnerability is tracked as CVE-2026-13165 with a CVSS 4.0 score of 8.6 (high severity). It was fixed in SzafirHost version 1.2.2.

Successful exploitation allows an attacker to execute arbitrary native code remotely by injecting a malicious native library into the archive that bypasses signature verification and is extracted without hash validation. This can lead to full system compromise on affected installations of SzafirHost prior to version 1.2.2.

Upgrade SzafirHost to version 1.2.2 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated in the vendor advisory, but the fix is confirmed in version 1.2.2.