CVE-2025-50325 Overview
CVE-2025-50325 is an authentication bypass vulnerability in BandiZip version 7.37, a widely deployed archive utility for Windows. The flaw allows remote attackers to bypass the Mark-of-the-Web (MotW) protection mechanism on affected installations. When users extract files from archives handled by BandiZip, the Zone.Identifier alternate data stream that Windows uses to flag content downloaded from untrusted zones is not propagated to extracted files. Attackers can leverage this weakness to deliver payloads that bypass SmartScreen, Protected View, and other Windows security features that rely on MotW to enforce restrictions on untrusted files.
Critical Impact
Files extracted from archives lose their untrusted-zone marking, allowing attacker-supplied executables, scripts, and Office documents to run without the security warnings Windows normally displays for internet-sourced content.
Affected Products
- BandiZip version 7.37 on Windows
- Earlier BandiZip 7.x branches that share the same extraction handler
- Any Windows environment relying on MotW-based execution restrictions for archives handled by BandiZip
Discovery Timeline
- 2026-07-22 - CVE-2025-50325 published to the National Vulnerability Database
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2025-50325
Vulnerability Analysis
The vulnerability stems from BandiZip 7.37 failing to write the Zone.Identifier NTFS alternate data stream to files extracted from archives originating from untrusted zones. Windows uses this stream to tag content with a ZoneId value that identifies internet-sourced files. Downstream security controls including Microsoft Defender SmartScreen, Office Protected View, Windows Script Host warnings, and Attachment Manager prompts depend on this tag to enforce protections. When the tag is missing, extracted binaries and documents execute as if they originated locally.
The issue is classified as an authentication bypass because it circumvents an operating-system trust boundary rather than a memory-safety flaw. The affected component is the archive extraction handler, which processes ZIP, RAR, 7Z, and other supported formats without preserving zone metadata inherited from the parent archive file.
Root Cause
BandiZip does not enforce zone identifier propagation during extraction. Bandisoft documents zone-identifier handling in its Bandisoft Zone Identifier Guide, yet version 7.37 does not apply this behavior consistently to all extracted content. Extracted files therefore inherit no ZoneId=3 marker even when the source archive was downloaded from the internet.
Attack Vector
An attacker hosts a malicious archive on a website, email attachment, or file-sharing service. A victim downloads the archive, which Windows correctly tags with MotW. When the victim opens the archive in BandiZip 7.37 and extracts its contents, the extracted payload does not carry the zone marker. Executing the payload skips SmartScreen reputation checks and Office sandboxing. See the GitHub CVE-2025-50325 reference for proof-of-concept documentation.
No verified exploit code has been published in the enriched dataset, so the mechanism is described in prose only.
Detection Methods for CVE-2025-50325
Indicators of Compromise
- Files extracted into user directories that lack a Zone.Identifier alternate data stream despite originating from a downloaded archive
- Presence of Bandizip.exe version 7.37 spawning child processes such as powershell.exe, wscript.exe, mshta.exe, or Office applications shortly after archive extraction
- Archives arriving from external email or web sources followed by execution of newly extracted binaries without SmartScreen prompts
Detection Strategies
- Enumerate Zone.Identifier streams on files under user download and temp paths using Get-Item -Stream * in PowerShell to identify extracted content missing the marker
- Correlate BandiZip process telemetry with subsequent process creation events to flag execution chains that bypass expected MotW prompts
- Hunt for archive-to-execution sequences where the parent archive has MotW set but child extracted files do not
Monitoring Recommendations
- Log Windows Sysmon Event IDs 1 (process create), 11 (file create), and 15 (file stream created) to track zone identifier writes and missing streams
- Alert on Bandizip.exe extractions that place executables, scripts, or LNK files into %TEMP%, %APPDATA%, or Downloads directories
- Baseline expected archive utilities in the environment and flag continued use of unpatched BandiZip 7.37 installations
How to Mitigate CVE-2025-50325
Immediate Actions Required
- Upgrade BandiZip to the latest release listed in the Bandisoft Version History that addresses zone identifier propagation
- Inventory endpoints for BandiZip 7.37 installations and prioritize remediation on systems that regularly process archives from external sources
- Restrict execution of newly extracted binaries through application control policies such as Windows Defender Application Control or AppLocker
Patch Information
Bandisoft publishes fixed versions through its official channel. Administrators should consult the Bandisoft Version History to identify the release that resolves MotW propagation and deploy it across all affected endpoints. No vendor advisory URL was included in the enriched dataset beyond the version history page.
Workarounds
- Standardize on an archive utility that preserves Mark-of-the-Web on extracted files until BandiZip is updated
- Enable Attack Surface Reduction rules that block executable content launched from mail and webmail clients
- Educate users to scan extracted content before execution and to right-click extracted files to confirm zone status through the file properties dialog
# Verify Zone.Identifier presence on an extracted file (PowerShell)
Get-Item -Path 'C:\Users\<user>\Downloads\extracted\payload.exe' -Stream Zone.Identifier
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
