CVE-2026-13165: SzafirHost RCE Vulnerability

CVE-2026-13165 Overview

CVE-2026-13165 is a parser differential vulnerability in SzafirHost, a native messaging host used by the Szafir electronic signature software distributed via elektronicznypodpis.pl. The flaw stems from inconsistent JAR archive parsing between signature verification and file extraction routines. SzafirHost verifies downloaded native library archives with JarFile (which reads the Central Directory) but extracts native libraries using JarInputStream (which reads sequentially from local file headers). An attacker who controls the served archive can smuggle a malicious DLL, SO, or DYLIB into the extraction path while retaining a valid signature. This mismatch enables remote code execution on client systems. The vendor addressed the issue in version 1.2.2.

Critical Impact
An attacker controlling the archive delivery channel can inject an unsigned native library that bypasses signature verification and executes with the privileges of the SzafirHost process.

Affected Products

SzafirHost native messaging component (Szafir electronic signature suite)
Versions prior to 1.2.2
Windows, Linux, and macOS deployments that load native libraries (DLL, SO, DYLIB)

Discovery Timeline

2026-06-29 - CVE-2026-13165 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13165

Vulnerability Analysis

The vulnerability is a classic parser differential [CWE-434] that arises when two components interpret the same ZIP/JAR archive using incompatible strategies. JarFile locates entries by reading the Central Directory at the end of the archive, while JarInputStream walks the file front-to-back, processing each local file header in order. Both approaches are valid ZIP parsing modes, but the ZIP specification does not require the two indexes to agree. When the signature verifier and the extractor disagree on which entries exist, an attacker can present two different views of the same archive to two different consumers within the same application.

SzafirHost fetches a native library archive over the network, verifies its signature using JarFile, and then extracts native libraries using JarInputStream. The archive-size check remains satisfied because the smuggled entry lives within the overall byte budget. No per-entry hash comparison is performed after extraction, so the injected library is written to the native temporary directory and subsequently loaded by the host process.

Root Cause

The root cause is trust placed in a signed manifest without enforcing byte-for-byte parity between the signed view of the archive and the extracted view. The signature covers only the entries visible through the Central Directory. Local file header entries that are absent from the Central Directory remain invisible to the verifier while still being consumed by the streaming extractor.

Attack Vector

An attacker who can serve or tamper with the archive, through a compromised distribution server, a man-in-the-middle position, or a malicious mirror, crafts a hybrid archive. The legitimate signed entries and Central Directory remain intact. The attacker appends a malicious native library as an additional local file header between the last legitimate entry and the Central Directory. JarFile sees only the original signed entries and reports a valid signature. JarInputStream reads sequentially and writes the attacker-controlled library to the temporary directory used by SzafirHost, which then loads it and executes attacker code. User interaction is required to trigger the signing workflow, but the resulting code executes natively on the victim host.

No verified proof-of-concept code is public. Refer to the CERT Poland CVE-2026-13165 Analysis for the vendor coordination details.

Detection Methods for CVE-2026-13165

Indicators of Compromise

Unexpected DLL, SO, or DYLIB files written to the SzafirHost native temporary directory that are not present in the signed archive manifest.
SzafirHost processes loading native libraries from user-writable temporary paths shortly after a signing operation.
Outbound network connections from the SzafirHost process to non-vendor infrastructure following library extraction.

Detection Strategies

Hunt for child processes spawned by SzafirHost that are not part of the standard Szafir toolchain.
Compare the SHA-256 hashes of extracted native libraries against known-good hashes shipped by the vendor for version 1.2.2 and later.
Alert on JAR or ZIP archives where the count of local file headers exceeds the count of Central Directory entries, which is the structural signature of this attack.

Monitoring Recommendations

Log all file-write and image-load events under the SzafirHost temporary extraction directory using endpoint telemetry.
Monitor DNS and HTTPS traffic destined for the Szafir update and library distribution endpoints for unexpected redirects or certificate anomalies.
Track SzafirHost version telemetry across the fleet and flag any host still running a version below 1.2.2.

How to Mitigate CVE-2026-13165

Immediate Actions Required

Upgrade SzafirHost to version 1.2.2 or later on every endpoint that has the Szafir signing software installed.
Audit endpoints for evidence of prior exploitation by inspecting the SzafirHost native temp directory for unsigned libraries.
Restrict outbound network access from the SzafirHost process to the vendor's official distribution domains only.

Patch Information

The vendor fixed the parser differential in SzafirHost version 1.2.2. The fix aligns signature verification and extraction on a consistent parser view of the archive so that entries not present in the Central Directory are rejected during extraction. See the CERT Poland CVE-2026-13165 Analysis and the Elektroniczny Podpis Overview for vendor guidance and download locations.

Workarounds

If immediate patching is not possible, block network access from SzafirHost to any host other than the vendor's signed distribution endpoints and enforce TLS pinning at the proxy layer.
Deploy application allowlisting to prevent SzafirHost from loading native libraries whose hashes do not match the vendor-published values.
Remove SzafirHost from systems that do not actively require the Szafir electronic signature workflow until the patch is applied.

bash

# Verify the installed SzafirHost version on Windows
reg query "HKLM\SOFTWARE\Szafir\SzafirHost" /v Version

# Verify on Linux/macOS
SzafirHost --version

# Expected output for a patched host:
# SzafirHost 1.2.2 (or later)