CVE-2025-50328: B1 Free Archiver Mark of the Web Bypass

CVE-2025-50328 Overview

A vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protections. When an archive is downloaded from the internet and extracted using B1 Free Archiver, the software fails to propagate the Zone.Identifier alternate data stream to the extracted files. As a result, these files can be executed without triggering Windows Defender SmartScreen warnings or security prompts, enabling untrusted code execution without standard security restrictions.

Critical Impact
Attackers can deliver malicious payloads via archived files that execute without Windows security warnings, bypassing SmartScreen protection entirely.

Affected Products

B1 Free Archiver v1.5.86

Discovery Timeline

2026-04-29 - CVE CVE-2025-50328 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-50328

Vulnerability Analysis

This vulnerability represents a security feature bypass affecting the Windows Mark of the Web (MotW) protection mechanism. When users download files from the internet, Windows applies a Zone.Identifier alternate data stream (ADS) to mark the file as originating from an untrusted source. This metadata enables Windows Defender SmartScreen and other security features to display warning prompts before executing potentially dangerous files.

B1 Free Archiver fails to preserve this critical security metadata when extracting files from downloaded archives. The application does not propagate the Zone.Identifier ADS from the parent archive to the extracted contents, effectively stripping the MotW designation from all extracted files.

Root Cause

The root cause lies in B1 Free Archiver's extraction implementation, which does not handle Windows NTFS alternate data streams during the file extraction process. When the archiver extracts files, it creates new files on disk without copying or generating the Zone.Identifier ADS that should be inherited from the downloaded archive container. This oversight in handling Windows security metadata allows extracted files to appear as locally-created content rather than internet-downloaded files.

Attack Vector

An attacker can exploit this vulnerability through the following attack chain:

The attacker creates a malicious payload (executable, script, or Office document with macros) and packages it within an archive format supported by B1 Free Archiver
The attacker hosts the archive on a web server or delivers it via email attachment
The victim downloads the archive, which receives the MotW designation from the browser
The victim extracts the archive using B1 Free Archiver v1.5.86
The extracted malicious files do not inherit the MotW, allowing them to execute without SmartScreen warnings
The malicious payload executes without standard Windows security prompts that would normally warn the user

This attack is particularly dangerous because it circumvents a fundamental Windows security layer that users rely on to identify potentially dangerous downloaded content.

Detection Methods for CVE-2025-50328

Indicators of Compromise

Recently extracted files lacking Zone.Identifier alternate data streams that originated from downloaded archives
Execution of unsigned or untrusted executables extracted from archive files without corresponding SmartScreen events
B1 Free Archiver process activity followed by immediate execution of extracted files

Detection Strategies

Monitor for process execution chains where B1 Free Archiver (b1freearchiver.exe) spawns or is followed by execution of newly created files
Implement file integrity monitoring to detect when files are extracted from archives and subsequently executed without MotW attributes
Deploy endpoint detection rules that flag executable files created without Zone.Identifier ADS in user download or temp directories

Monitoring Recommendations

Enable Windows Security event logging for file creation and execution events in user-accessible directories
Configure SIEM rules to correlate archive extraction events with subsequent code execution
Monitor for behavioral patterns consistent with MotW bypass attacks, such as rapid extraction-to-execution sequences

How to Mitigate CVE-2025-50328

Immediate Actions Required

Consider replacing B1 Free Archiver with an alternative archive utility that properly preserves MotW attributes
Implement application whitelisting to prevent execution of unsigned or unexpected executables
Enable Windows Attack Surface Reduction (ASR) rules that block execution of potentially obfuscated scripts and untrusted processes

Patch Information

No vendor patch information is currently available for this vulnerability. Users should monitor the B1 Organization Homepage and the GitHub B1 Free Archiver repository for security updates.

Workarounds

Use Windows built-in archive extraction or alternative archivers known to preserve MotW attributes
Manually inspect extracted files for Zone.Identifier ADS before execution using PowerShell: Get-Item <filename> -Stream *
Implement organizational policies requiring that downloaded archives be scanned before extraction
Deploy endpoint protection solutions that can detect and block MotW bypass attempts

bash

# Check for Zone.Identifier on extracted files using PowerShell
Get-ChildItem -Path "C:\Users\<username>\Downloads\extracted\" -Recurse | ForEach-Object {
    $streams = Get-Item $_.FullName -Stream * 2>$null
    if (-not ($streams.Stream -contains "Zone.Identifier")) {
        Write-Warning "Missing MotW: $($_.FullName)"
    }
}