Windows Libarchive CVE-2026-70062

Exploitation requires the target system to parse an attacker-supplied, maliciously crafted archive using the Windows-bundled libarchive component (e.g., tar.exe/bsdtar or any application/service that invokes the library). The CVSS vector lists PR:N (no authentication) and UI:N (no interaction), implying an unattended/automated archive-processing context; however, in interactive deployments a user must typically initiate extraction of the hostile archive, which is a meaningful limiting factor. The primary constraint is attack complexity: AC:H reflects that a double free must be won and the resulting heap corruption reliably shaped into code execution, which demands precise heap grooming rather than a deterministic single request. Systems that never process untrusted archives are not realistically exposed.

Signals are mixed, pointing to a serious-but-not-emergency vulnerability. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N) reflects a network-reachable, unauthenticated memory-corruption flaw with total CIA impact, but the AC:H flag and CWE-415 (double free) indicate that reliable exploitation requires non-trivial heap manipulation rather than a simple one-shot request. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale), and Technical Impact=total (full compromise if achieved). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available weaponized code. Notable tension to verify: the vector asserts UI:N (no user interaction), yet a double free in an archive-parsing library (libarchive) typically requires the target to open or extract an attacker-supplied archive - the UI:N rating likely assumes an automated service that parses archives unattended; defenders should confirm whether their deployment auto-processes untrusted archives. Overall this is a genuine high-severity patching priority given ubiquitous Windows exposure and total technical impact, but the AC:H rating, SSVC Automatable=no, and absence of exploitation signals argue against treating it as an in-the-wild emergency.

An attacker crafts a malformed archive (e.g., tar/zip) that triggers the double-free condition when parsed by Windows' bundled libarchive (such as tar.exe/bsdtar or any service invoking the library). When the target processes the archive, the double free corrupts heap memory, which a skilled attacker grooms to achieve arbitrary code execution. No public exploit code is identified at time of analysis, and the CVSS AC:H rating indicates reliable exploitation requires careful heap control.