Windows Compressed Folder CVE-2026-70019

The victim must actively open or expand the crafted compressed archive using Windows Explorer's built-in Compressed Folder feature on an affected Windows 11 or Windows Server 2025 build - passive drive-by exploitation without user interaction is not possible per the UI:R CVSS metric. The attacker needs no authentication (PR:N) and no elevated privileges on any system; only the ability to deliver the malicious archive to the victim via network (email, web download, SMB share, etc.) is required. Exploitation is constrained to Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Windows 10 systems are not affected per available version data. The attack surface is further limited to scenarios where the victim's Windows account has read access to the targeted sensitive file, meaning the attacker can disclose only files readable by the victim's session.

The CVSS 3.1 base score of 6.5 appropriately reflects the meaningful but bounded risk profile of this vulnerability. The network attack vector (AV:N) and no-privilege-required (PR:N) attributes lower the delivery barrier significantly - any attacker capable of sending an email or hosting a download can attempt exploitation. However, the mandatory user interaction (UI:R) introduces a social engineering dependency that real-world exploitation cannot bypass. The confidentiality impact (C:H) is the primary concern: if the hard link resolves to a high-value file (credential stores, configuration files with secrets, private keys), disclosure could be severe despite the moderate composite score. No EPSS data was provided, no CISA KEV listing exists, and no POC is identified, placing this in the 'theoretical but undemonstrated' exploitation category at time of analysis. The scope is further constrained to Windows 11 and Server 2025, excluding Windows 10, which limits the affected population compared to a universal Windows flaw. Priority should reflect patch cadence rather than emergency response absent exploitation signals.

An attacker crafts a malicious ZIP archive containing an NTFS hard link entry that targets a sensitive local file on the victim's system (for example, a cached credential file or a certificate store). The archive is delivered to the victim via a phishing email or a drive-by download. When the victim opens the archive in Windows Explorer using the built-in Compressed Folder handler, the handler follows the hard link, reads the sensitive target file, and the contents are disclosed - either written to an attacker-controlled destination embedded in the archive structure or accessible via a network share path encoded in the link.