CVE-2021-26623: Bandisoft Bandizip

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function.

Affected products

• Bandisoft Bandizip: before 7.19 (fixed in 7.19)

Published 2022-04-01. Last modified 2026-06-17.