Windows Libarchive CVE-2026-69985

Exploitation requires the victim to open or process a maliciously crafted archive file handled by the Windows Libarchive component - the UI:R metric confirms this mandatory user interaction, which is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and the attack is network-deliverable (AV:N) since the malicious archive can be delivered remotely (email, web download, share). There is no indication of a non-default configuration requirement; the component is present across the listed Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025 builds below the patched versions. The dependence on user interaction means it cannot be automated for mass/wormable exploitation (consistent with SSVC Automatable=no), and exploitation success is scoped to the privilege level of the user who opens the file.

This is a genuine high-priority vulnerability but with an important limiting factor that tempers the raw 8.8 CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated code execution - but the UI:R flag means a user must take an action (open a malicious archive), so this is not a wormable, zero-click flaw. These signals are consistent and reinforce each other. The CISA SSVC framework corroborates a measured posture: Exploitation=none (no observed exploitation), Automatable=no (consistent with UI:R - it cannot be mass-automated without user action), and Technical Impact=total (consistent with C:H/I:H/A:H full compromise). No EPSS score was provided in the input, so exploitation-probability modeling cannot be incorporated. This is NOT a CISA KEV entry and no POC is referenced, so there is no evidence of active exploitation or public exploit code at this time. Net assessment: a serious, patch-now-class memory-corruption RCE in a ubiquitous platform, but realistic risk is gated by the required user interaction and the current absence of any exploitation signal - prioritize patching, but it is not a drop-everything emergency on the level of a zero-click wormable bug.

An attacker crafts a malicious archive file (e.g., delivered via email, download, or a file-sharing link) that triggers the heap-based buffer overflow in the Windows Libarchive parser. When a victim opens or extracts the archive, the overflow corrupts heap memory and allows the attacker to execute arbitrary code in the context of the user. No public proof-of-concept or exploit code is referenced in the available data.