PT-2026-36002 · Unknown · B1 Free Archiver

Published 2026-04-29 · Updated 2026-04-30 · CVE-2025-50328

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions B1 Free Archiver version 1.5.86

Description An issue exists where files extracted from downloaded archives bypass Windows Mark of the Web (MotW) protections. The software fails to propagate the Zone.Identifier alternate data stream—a mechanism used by Windows to identify files originating from the internet—to the extracted files. This allows files to be executed without triggering security prompts or Windows Defender SmartScreen warnings, potentially leading to the execution of untrusted code without standard security restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-50328

Affected Products

B1 Free Archiver

References · 4

• 🔥 https://github.com/math69b/B1FREE/blob/main/B1%20Free%20Archiver%20version · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50328 · Security Note
• https://twitter.com/VulmonFeeds/status/2049670139201618327 · Twitter Post
• https://b1.org · Note