CWE-1475 Incomplete Data/State Propagation

The product passes control to another component or function, or it performs a state transition, but it does not provide some security-critical data/state that is needed by the receiving component/function.

• Other: Unexpected State, Varies by Context — The consequences will vary depending on the type of data/state that is omitted, along with the functionality that the data/state supports. • Access Control: Gain Privileges or Assume Identity, Bypass Protection Mechanism — If the data/state is needed for a security decision, such as authentication or authorization, then this could allow attackers to bypass the intended protection mechanism.

• [Implementation] Clearly identify security-critical data/state structures and ensure that they are propagated when necessary. Be careful of error conditions that could redirect control flow in a way that prevents the propagation from occurring.

• CVE-2026-58052: Chain: File archive product for Windows does not preserve Mark-of-the-Web (MOTW) when extracting an archive (CWE-1475) due to incorrect matching (CWE-697) and canonicalization. • CVE-2025-50328: File archive product for Windows does not propagate the Zone.Identifier alternate data stream to extracted files, allowing a Mark-of-the-Web (MOTW) bypass. • CVE-2026-44394: Chain: Identity service does not propagate an expiry for a token (CWE-1475), allowing attackers to bypass intended token lifetime restrictions (CWE-863).