Szafir SDK flaws enable arbitrary code execution
Two vulnerabilities in Poland's Szafir SDK Web plugin let attackers spoof origin URLs and load unsigned malicious libraries for code execution.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities in Szafir SDK Web, a browser plug-in used to launch the SzafirHost application for downloading required files. CVE-2026-26927 allows an unauthenticated attacker to craft a malicious website that invokes SzafirHost with an arbitrary document_base_url parameter, which is not validated against the actual calling application. If a victim has previously accepted execution with the "remember" option, the application will silently launch in the attacker-controlled context without any further prompt, potentially fetching additional files from the attacker's site.
CVE-2026-26928 affects SzafirHost's dynamic library update mechanism. While JAR files are checked against a trusted hash list or vendor signature, the application fails to verify hashes or digital signatures for DLL, SO, JNILIB, or DYLIB files, allowing an attacker to supply a malicious native library that is saved to the user's temp folder and executed. Both issues were reported through CERT Polska's coordinated vulnerability disclosure process and have been patched in versions 0.0.17.4 and 1.1.0 respectively. No evidence of active exploitation is mentioned in the advisory.
Mentioned in this report
Detection guidance
SzafirHost Launching with Attacker-Controlled Document Base URL
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SzafirHost process spawned with document_base_url parameter pointing to non-standard or suspicious hosts, indicating potential exploitation of CVE-2026-26927. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SzafirHost Launching with Attacker-Controlled Document Base URL
description: Detects SzafirHost process execution with document_base_url parameter
pointing to non-standard or suspicious hosts, typical of CVE-2026-26927 exploitation
where an attacker crafts a malicious website to invoke SzafirHost with arbitrary
parameters.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \SzafirHost.exe
CommandLine|contains: document_base_url=
filter_legitimate_domains:
CommandLine|contains:
- document_base_url=http://localhost
- document_base_url=https://szafir
condition: selection and not filter_legitimate_domains
falsepositives:
- Legitimate SzafirHost invocations from trusted internal or vendor domains
- Administrative testing with controlled document_base_url parameters
level: medium
id: 1576f1b8-d4d6-5efc-82d8-51f80441963b
status: experimental
author: Vorant
SzafirHost Loading Unsigned Native Libraries from Temp Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SzafirHost loading DLL, SO, JNILIB, or DYLIB files from user temp folders without signature validation, indicative of CVE-2026-26928 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SzafirHost Loading Unsigned Native Libraries from Temp Directory
description: Detects SzafirHost process loading native libraries (DLL, SO, JNILIB,
DYLIB) from temporary directories without signature verification, typical of CVE-2026-26928
where malicious native libraries are placed in temp and executed by the application.
tags:
- attack.persistence
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \SzafirHost.exe
ImageLoaded|contains:
- \AppData\Local\Temp\
- \Temp\
ImageLoaded|endswith:
- .dll
- .so
- .jnilib
- .dylib
filter_microsoft_temp:
ImageLoaded|contains: \AppData\Local\Temp\Microsoft
condition: selection and not filter_microsoft_temp
falsepositives:
- Legitimate application updates that temporarily stage libraries in temp before installation
- Development or testing scenarios where SzafirHost loads unsigned development libraries
level: high
id: 10950828-05db-5ad3-ad7a-b0af6abdfd1c
status: experimental
author: Vorant
SzafirHost Dynamic Library Update Without Hash Verification
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects file write operations to temp directory of native library files by SzafirHost process, potentially unverified by hash or signature checks as per CVE-2026-26928. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SzafirHost Dynamic Library Update Without Hash Verification
description: Detects SzafirHost writing native library files to temp directories as
part of the update mechanism, where hash or signature verification may be bypassed
per CVE-2026-26928.
tags:
- attack.stealth
- attack.t1574.001
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \SzafirHost.exe
TargetFilename|contains:
- \AppData\Local\Temp\
- \Temp\
TargetFilename|endswith:
- .dll
- .so
- .jnilib
- .dylib
filter_legitimate_updates:
TargetFilename|contains: SzafirHost
condition: selection and not filter_legitimate_updates
falsepositives:
- Legitimate SzafirHost library updates to temp staging areas prior to verification
and deployment
- Antivirus or security software monitoring and copying libraries to temp for inspection
level: medium
id: 2c4faa5b-80f7-55ba-88bd-ae68f9ac8ace
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-26927
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs