Windows Libarchive CVE-2026-69973

Exploitation requires a victim to extract or process an attacker-crafted archive (e.g., tar/zip) using the libarchive component integrated into Windows; the crafted archive contains path entries with traversal sequences that escape the intended extraction directory to write files elsewhere. The primary limiting factor is the mandatory user interaction (UI:R) - the attack cannot fire without the victim actively opening/extracting the malicious archive - and SSVC Automatable:no indicates it cannot be reliably mass-automated. Impact is limited to integrity (file tampering/planting); there is no confidentiality disclosure or availability/denial-of-service component. No authentication is required of the attacker (PR:N / unauthenticated), but the attacker does not act directly against the target - they must induce the victim to handle the file.

This is a medium-severity integrity-only issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). While the vector is network-based and requires no privileges (PR:N), exploitation is gated by required user interaction (UI:R) - a victim must actively extract an attacker-supplied archive - and the impact is confined to integrity (I:H), with no confidentiality or availability loss. All exploitation-maturity signals point AWAY from urgent priority: CISA SSVC records Exploitation:none, Automatable:no, and Technical Impact:partial, and there is no CISA KEV listing and no identified public exploit. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed; absence of EPSS is a data gap, not a low score. The signals are internally consistent rather than conflicting (medium CVSS, no active exploitation, non-automatable, user-interaction-dependent), so this reads as a genuine-but-non-emergency patch-in-normal-cycle item rather than a high-urgency threat - tempered only by the enormous install base of the affected Windows platforms.

An attacker crafts a malicious archive (e.g., a tar/zip containing entries with '../' path-traversal sequences) and delivers it to a victim over the network via download, email, or a shared file. When the victim extracts the archive using the libarchive component bundled in Windows, the traversal entries cause files to be written outside the intended extraction directory, letting the attacker plant or overwrite files on the victim's system. No public exploit code has been identified at time of analysis, and successful attack depends on the victim choosing to extract the attacker's archive.