B1 Free Archiver version 1.5.86 fails to propagate the Zone.Identifier alternate data stream that Windows uses to mark files downloaded from the internet. As a result, when a malicious archive is extracted, the contained files are treated as local, run without triggering Windows Defender SmartScreen or other security prompts, and can execute arbitrary code. This flaw is an authorization bypass (CWE‑290) that allows untrusted data to be accepted as trusted behaviour.

The vulnerability exists only in B1 Free Archiver 1.5.86 and affects Windows workstations or servers that use the program to extract archives downloaded from external sources. Any user or service that extracts files with this version is susceptible.

The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been widely abused. The CVSS score of 7.3 signals high severity. The likely attack vector is local extraction of a malicious archive supplied by an attacker, which can be performed by a user or process with sufficient privileges. Once the files are extracted they execute with the extracting user’s privileges, enabling local code execution.