B1 Free Archiver v1.5.86 fails to propagate the Zone.Identifier alternate data stream to files extracted from an archive. This bypasses the Windows Mark of the Web, allowing files to run without triggering Windows Defender SmartScreen or other security prompts. An attacker could deliver a malicious archive, have it extracted on a target machine, and the resulting executables would execute with the user’s privileges, enabling arbitrary code execution and compromising confidentiality, integrity, and availability.

The flaw is present only in B1 Free Archiver version 1.5.86. It affects Windows operating systems that use this archiver to extract downloaded archives. Systems that rely on B1 Free Archiver for file extraction are at risk.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. However, the flaw permits arbitrary local code execution if an attacker can provide a malicious archive and the target user extracts it. The attack vector is likely the local extraction of an untrusted archive, which bypasses the Windows security model because the software does not apply the Zone.Identifier stream. Defensive controls such as Windows Defender SmartScreen and mandatory Zone.Identifier settings could mitigate the risk, but their effectiveness is diminished when the archiver does not set the proper alternate data stream.