CVE-2025-50328 B1 CVE debrief

Who should care

Defenders and security teams responsible for managing and securing B1 Free Archiver installations should assess exposure and prioritize patching to prevent potential code execution and bypass of Windows security protections. They should also review incident response plans, implement additional security controls, and monitor for suspicious activity related to extracted files. Vulnerability management and security teams should verify and patch B1 Free Arch 器

Why it matters

Defenders should prioritize verifying and patching B1 Free Archiver installations to prevent potential code execution and bypass of Windows security protections.

• Potential code execution without standard security restrictions
• Bypass of Windows Mark of the Web (MotW) protections
• Untrusted file execution without Windows Defender SmartScreen warnings

Technical summary

The vulnerability in B1 Free Archiver v1.5.86 allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protections, enabling untrusted code execution without standard security restrictions. This occurs because the software fails to propagate the 'Zone.Identifier' alternate data stream to the extracted files, potentially leading to untrusted file execution without Windows Defender SmartScreen warnings or security prompts. Defenders should assess exposure and prioritize patching to prevent potential code execution and bypass of Windows security protections.

Defensive priority

Defenders should prioritize verifying and patching B1 Free Archiver installations to prevent potential code execution.

Recommended defensive actions

• Verify B1 Free Archiver installations and update to a patched version if available
• Implement additional security controls to monitor and restrict file execution
• Review and update incident response plans to address potential code execution
• Conduct vulnerability scanning to identify exposed systems
• Prioritize patching based on asset criticality and potential impact
• Monitor for suspicious activity related to extracted files
• Review system logs for indicators of compromise

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in B1 Free Archiver v1.5.86, which allows files extracted from downloaded archives to bypass Windows Mark of the Web (MotW) protections. Additional information on affected versions, remediation, and specific defensive measures is needed. Defenders should verify and patch B1 Free Archiver installations, review incident response plans, and implement additional security controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.