BusyBox libarchive EUVD-2026-107403

Exploitation requires a victim to locally extract/process an attacker-crafted archive (e.g., tar) using a BusyBox applet backed by the vulnerable libarchive component; the malicious archive must contain symlink or path entries that traverse outside the intended extraction directory. Limiting factors: mandatory user interaction (UI:R - the target must open the malicious file or visit a malicious page), local attack vector (AV:L - no network service is directly exposed), and resulting writes occur only with the current user's privileges, so impact scales with how privileged the extracting process is. Risk is materially higher in automated or server-side pipelines that unpack untrusted archives without user vetting; it is low for interactive users who do not open untrusted archives. Specific affected/patched versions are not stated in the input.

This is a moderate-severity, local-vector file-creation flaw whose real-world priority is low-to-moderate rather than urgent. The provided CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 6.1) is internally consistent: exploitation requires the victim to locally process attacker-supplied archive content (AV:L + UI:R), yields arbitrary file creation (I:H) with no confidentiality loss (C:N) and minor availability impact (A:L). Note a wording tension worth flagging: the description calls these 'remote attackers,' but the CVSS vector is AV:L - the attack is remote only in the sense that a malicious file/page is delivered remotely, while the vulnerable file operation executes locally when the victim opens it; treat this as local-with-social-engineering, not network-remote. No EPSS score, no CISA KEV listing, and no public POC were supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' The sole source is a ZDI advisory (ZDI-26-705 / ZDI-CAN-27556), which typically reflects coordinated disclosure with a patch rather than observed in-the-wild use. Net: genuine integrity risk (symlink-based path traversal writing outside the extraction directory can lead to code execution or config tampering), but gated by required user interaction and local context, so it belongs in routine patch cycles rather than emergency response - unless deployed in automated extraction pipelines that process untrusted archives.

An attacker crafts a malicious archive (e.g., tar) containing entries whose symlink/path components traverse outside the intended extraction directory, then lures a victim into downloading and extracting it with a BusyBox applet that uses the vulnerable libarchive component. On extraction, the crafted path causes a file to be written to an attacker-chosen location in the context of the current user, potentially overwriting startup scripts or configuration to achieve code execution. No public exploit code is identified at time of analysis, but ZDI-confirmed path-traversal archive bugs are generally straightforward to reproduce.