SzafirHost JAR parser mismatch enables RCE
A signature-bypass vulnerability in SzafirHost allows attackers to inject malicious native libraries into signed archives, leading to remote code execution.
CERT Polska disclosed CVE-2026-13165, a critical vulnerability in SzafirHost software that exploits a parser mismatch in JAR file handling. The flaw arises because SzafirHost uses different parsers for verification and extraction: JarFile (which reads the Central Directory) validates signatures, while JarInputStream (which reads sequentially from local file headers) extracts native libraries. An attacker controlling the served archive can inject a malicious native library (DLL/SO/DYLIB) as a local-file-header entry positioned between the last legitimate entry and the Central Directory, without adding it to the Central Directory itself.
This design allows the signature verifier to accept the archive as validly signed while the extractor writes the attacker-controlled library to the native temp directory with no integrity check. The archive-size validation still passes, making the attack difficult to detect. Successful exploitation results in remote code execution when the malicious native library is loaded. The vulnerability was fixed in SzafirHost version 1.2.2.
The issue was responsibly reported by Mariusz Maik and coordinated through CERT Polska's vulnerability disclosure process. Organizations using SzafirHost should upgrade to version 1.2.2 immediately to mitigate this risk.
Mentioned in this report
Detection guidance
Native Library Written to Temp Directory by SzafirHost/Java Process
Detects a SzafirHost or hosting JVM process writing a DLL/SO/DYLIB file to a temp directory, consistent with JAR parser-mismatch exploitation (CVE-2026-13165) that smuggles unsigned native libraries past signature verification. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Native Library Write by SzafirHost/Java Process
id: d4a55b77-4973-57d4-bde8-7df6377f7a75
status: experimental
description: Detects creation of native library files (.dll/.so/.dylib) in temp directories
by SzafirHost or Java-related processes, consistent with the JAR parser mismatch
vulnerability (CVE-2026-13165) where JarInputStream extracts unsigned local-file-header
entries that bypass JarFile signature verification.
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- SzafirHost
- java.exe
- javaw.exe
TargetFilename|contains:
- \Temp\
- \AppData\Local\Temp\
TargetFilename|endswith:
- .dll
- .so
- .dylib
filter:
TargetFilename|contains:
- \jna-
- \jssc\
condition: selection and not filter
falsepositives:
- Legitimate JNA/JSSC or other Java native-bridge libraries extracting bundled native
code to temp during normal operation
- Software update or installer routines that stage native libraries in temp before
installation
level: medium
tags:
- attack.t1574.010
- attack.defense_evasion
- cve.2026.13165
author: Vorant
Native Library Loaded From Temp Path Into Java/SzafirHost Process
Detects a native library (DLL/SO/DYLIB) being loaded into a Java or SzafirHost process from a temp/user-writable directory, indicating potential execution of the malicious native library injected via the JAR parser mismatch flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Native Library Loaded From Temp Directory by Java Process
id: 789d9bbc-0cd4-5115-8252-64f204cfe291
status: experimental
description: Detects image/module load events where a native library is loaded from
a temp or user-writable directory into a Java-related or SzafirHost process, consistent
with exploitation of CVE-2026-13165, where an unsigned native library smuggled past
signature verification is subsequently loaded and executed.
logsource:
category: image_load
product: windows
detection:
selection:
Image|contains:
- SzafirHost
- java.exe
- javaw.exe
ImageLoaded|contains:
- \Temp\
- \AppData\Local\Temp\
ImageLoaded|endswith:
- .dll
filter:
ImageLoaded|contains:
- \jna-
- \jssc\
condition: selection and not filter
falsepositives:
- Legitimate JNA-based applications loading bundled native libraries from a temp extraction
path
- Enterprise Java applications that stage vendor native libraries in per-user temp
folders as part of normal operation
level: high
tags:
- attack.t1203
- attack.execution
- cve.2026.13165
author: Vorant
SzafirHost Process Spawning Child Process After Native Library Load
Detects a SzafirHost or hosting JVM process spawning an unexpected child process shortly after loading a native library from a temp directory, suggesting successful RCE via the JAR parser mismatch vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by SzafirHost/Java After Native Library Load
id: 19e5f1ce-7c6c-5d6c-9f5c-9f18b5e5eb7b
status: experimental
description: Detects command-shell or scripting engine processes spawned from SzafirHost/Java
processes, which may indicate code execution following successful exploitation of
the JAR parser mismatch vulnerability (CVE-2026-13165) where a malicious native
library was loaded and executed.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains:
- SzafirHost
- java.exe
- javaw.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \rundll32.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Administrative scripts or update mechanisms legitimately invoked by the Java runtime
hosting SzafirHost
- Custom enterprise integrations that shell out from the JVM for scheduled maintenance
tasks
level: medium
tags:
- attack.t1203
- attack.execution
- cve.2026.13165
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-13165/
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free