Szafir SDK flaws enable arbitrary code execution
Two vulnerabilities in Poland's Szafir SDK Web plugin let attackers spoof origin URLs and load unsigned malicious libraries for code execution.
CERT Polska coordinated disclosure of two vulnerabilities in Szafir SDK Web, a browser plug-in used to launch the SzafirHost application for downloading required files. CVE-2026-26927 allows an unauthenticated attacker to craft a malicious website that invokes SzafirHost with an arbitrary document_base_url parameter, which is not validated against the actual calling application. If a victim has previously accepted execution with the "remember" option, the application will silently launch in the attacker-controlled context without any further prompt, potentially fetching additional files from the attacker's site.
CVE-2026-26928 affects SzafirHost's dynamic library update mechanism. While JAR files are checked against a trusted hash list or vendor signature, the application fails to verify hashes or digital signatures for DLL, SO, JNILIB, or DYLIB files, allowing an attacker to supply a malicious native library that is saved to the user's temp folder and executed. Both issues were reported through CERT Polska's coordinated vulnerability disclosure process and have been patched in versions 0.0.17.4 and 1.1.0 respectively. No evidence of active exploitation is mentioned in the advisory.
Mentioned in this report
Detection guidance
SzafirHost Launching with Attacker-Controlled Document Base URL
Detects SzafirHost process spawned with document_base_url parameter pointing to non-standard or suspicious hosts, indicating potential exploitation of CVE-2026-26927. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SzafirHost Launching with Attacker-Controlled Document Base URL
description: Detects SzafirHost process execution with document_base_url parameter
pointing to non-standard or suspicious hosts, typical of CVE-2026-26927 exploitation
where an attacker crafts a malicious website to invoke SzafirHost with arbitrary
parameters.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \SzafirHost.exe
CommandLine|contains: document_base_url=
filter_legitimate_domains:
CommandLine|contains:
- document_base_url=http://localhost
- document_base_url=https://szafir
condition: selection and not filter_legitimate_domains
falsepositives:
- Legitimate SzafirHost invocations from trusted internal or vendor domains
- Administrative testing with controlled document_base_url parameters
level: medium
id: 1576f1b8-d4d6-5efc-82d8-51f80441963b
status: experimental
author: Vorant
SzafirHost Loading Unsigned Native Libraries from Temp Directory
Detects SzafirHost loading DLL, SO, JNILIB, or DYLIB files from user temp folders without signature validation, indicative of CVE-2026-26928 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SzafirHost Loading Unsigned Native Libraries from Temp Directory
description: Detects SzafirHost process loading native libraries (DLL, SO, JNILIB,
DYLIB) from temporary directories without signature verification, typical of CVE-2026-26928
where malicious native libraries are placed in temp and executed by the application.
tags:
- attack.persistence
- attack.t1574.002
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \SzafirHost.exe
ImageLoaded|contains:
- \AppData\Local\Temp\
- \Temp\
ImageLoaded|endswith:
- .dll
- .so
- .jnilib
- .dylib
filter_microsoft_temp:
ImageLoaded|contains: \AppData\Local\Temp\Microsoft
condition: selection and not filter_microsoft_temp
falsepositives:
- Legitimate application updates that temporarily stage libraries in temp before installation
- Development or testing scenarios where SzafirHost loads unsigned development libraries
level: high
id: 10950828-05db-5ad3-ad7a-b0af6abdfd1c
status: experimental
author: Vorant
SzafirHost Dynamic Library Update Without Hash Verification
Detects file write operations to temp directory of native library files by SzafirHost process, potentially unverified by hash or signature checks as per CVE-2026-26928. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SzafirHost Dynamic Library Update Without Hash Verification
description: Detects SzafirHost writing native library files to temp directories as
part of the update mechanism, where hash or signature verification may be bypassed
per CVE-2026-26928.
tags:
- attack.defense-evasion
- attack.t1574.002
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \SzafirHost.exe
TargetFilename|contains:
- \AppData\Local\Temp\
- \Temp\
TargetFilename|endswith:
- .dll
- .so
- .jnilib
- .dylib
filter_legitimate_updates:
TargetFilename|contains: SzafirHost
condition: selection and not filter_legitimate_updates
falsepositives:
- Legitimate SzafirHost library updates to temp staging areas prior to verification
and deployment
- Antivirus or security software monitoring and copying libraries to temp for inspection
level: medium
id: 2c4faa5b-80f7-55ba-88bd-ae68f9ac8ace
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-26927
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free