SzafirHost performs signature verification of JAR files using JarInputStream, which reads from the start of the file, but loads classes using JarFile/URLClassLoader, which reads the Central Directory at the end of the file. This inconsistency can be exploited by combining a legitimate signed JAR with a malicious ZIP structure, allowing the malicious classes to be loaded despite passing signature verification. This leads to a remote code execution vulnerability classified under CWE-434. The vulnerability has been addressed in version 1.2.1 of SzafirHost.

Successful exploitation can result in remote code execution on systems running vulnerable versions of SzafirHost. This allows attackers to execute arbitrary code with the privileges of the application, posing a significant security risk. No known exploits are currently reported in the wild.

This vulnerability has been fixed in SzafirHost version 1.2.1. Users should upgrade to this version or later to remediate the issue. Since the vendor advisory confirms the fix, no additional mitigation steps are required beyond applying the official update.