Critical RCE Vulnerability Discovered in SzafirHost Software

CERT Polska disclosed CVE-2026-13165, a high-severity RCE in SzafirHost (affecting all versions prior to 1.2.2) where inconsistent parsing of signed native library archives permits insertion of malicious DLL/SO/DYLIB entries that bypass signature checks and can be executed from the native temporary directory; the issue is fixed in SzafirHost 1.2.2 (released 2026-06-01) and organizations are urged to update.