EUVD-2026-72994
GHSA-8h33-764m-m2w4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated and network-delivered, but exploiting the Compressed Folder parser realistically requires the victim to open/extract a crafted archive, so UI:R rather than the vendor's UI:N; full RCE impact justifies C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to process an attacker-supplied malicious compressed archive with the built-in Windows Compressed Folder / ZIP handler, which is present and enabled by default on all listed Windows SKUs; the primary limiting factor is delivery and the victim opening or extracting the archive (despite the vendor's UI:N rating, realistic exploitation is gated on a user handling the crafted file). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a 9.8 and describes an unauthenticated, low-complexity network path with full triage impact, which is why even a mid-sized municipal IT team in olsztyn should treat this as urgent and prioritize the update. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for CVE-2026-69496 via the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69496), installing at least the fixed build for each SKU: 6.2.9200.26349 (Server 2012), 6.3.9600.23397 (Server 2012 R2), 10.0.14393.9512 (2016/1607), 10.0.17763.9245 (1809/2019), 10.0.19044.7725 / 10.0.19045.7725 (Win10 21H2/22H2), 10.0.20348.5622 (Server 2022), 10.0.22631.7582 (Win11 23H2), 10.0.26100.9445 / 33438 (24H2 / Server 2025), 10.0.26200.9445 (25H2), and 10.0.28000.2954 (26H1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Windows endpoints (Windows 10, 11, Server 2012/2016/2019/2022/2025) via asset inventory and prioritize mission-critical systems for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today