CVE-2021-26623: 
Bandisoft Bandizip vulnerability analysis and mitigation

A remote code execution vulnerability identified as CVE-2021-26623 was discovered in the ark library. The vulnerability stems from an incomplete check for the 'xheader_decode_path_record' function's parameter length value. This vulnerability affects Bandizip versions up to (excluding) 7.19 and Microsoft Windows systems (NVD).

The vulnerability is classified with multiple CWE identifications: CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). The severity of this vulnerability is rated as CRITICAL with a CVSS v3.1 base score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) according to NVD assessment. KrCERT/CC provided a different assessment with a HIGH severity score of 7.8 (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

The vulnerability allows remote attackers to execute malicious code through the affected function. Given the CRITICAL severity rating and the complete compromise of confidentiality, integrity, and availability indicated by the CVSS score, successful exploitation could lead to full system compromise (NVD).

The vulnerability requires no privileges or user interaction for exploitation according to the NVD assessment, making it highly exploitable. The attack vector is network-accessible, indicating that the vulnerability can be exploited remotely (NVD).

Users should upgrade to Bandizip version 7.19 or later to mitigate this vulnerability (NVD).