A security bypass vulnerability in B1 Free Archiver v1.5.86 allows attackers to execute untrusted code by circumventing Windows Mark of the Web protections.

The software fails to propagate the Zone.Identifier alternate data stream to extracted files, which allows downloaded archives to bypass Windows Defender SmartScreen warnings. This vulnerability is unauthenticated and can be triggered by an attacker supplying a malicious archive to a user.

The ability to bypass Mark of the Web protections significantly lowers the barrier for malware delivery and execution on Windows systems. With a CVSS score of 7.3, this flaw presents a high risk because it effectively neutralizes a critical OS level security control, potentially leading to unauthorized code execution and full system compromise.

Immediate Action: There is no official patch currently available; users should exercise extreme caution when downloading and extracting archives from untrusted sources.

Proactive Monitoring: Security teams should monitor endpoint logs for unexpected execution of files originating from web browsers or archive utilities.

Compensating Controls: Deploy endpoint detection and response (EDR) solutions to identify and block suspicious file execution patterns that attempt to circumvent system security prompts.

Public Exploit Available: Unknown.

Given the lack of a vendor patch, organizations should consider restricting the use of B1 Free Archiver in high security environments. Until a fix is released, prioritize user education regarding the risks of extracting archives from unknown sources and ensure that robust EDR solutions are active on all endpoints.