EUVD-2026-72994
GHSA-8h33-764m-m2w4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious ZIP archive
-
DeliveryDeliver via email or download
-
ExploitVictim opens with Compressed Folder handler
-
ExecutionOverflow zipfldr heap buffer
-
ImpactExecute arbitrary code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to process an attacker-supplied malicious compressed archive with the built-in Windows Compressed Folder / ZIP handler, which is present and enabled by default on all listed Windows SKUs; the primary limiting factor is delivery and the victim opening or extracting the archive (despite the vendor's UI:N rating, realistic exploitation is gated on a user handling the crafted file). No authentication is required (PR:N per the CVSS vector), and no non-default feature must be enabled since Compressed Folder support ships on by default. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a 9.8 and describes an unauthenticated, low-complexity network path with full triage impact, which is why even a mid-sized municipal IT team in olsztyn should treat this as urgent and prioritize the update. However, the realism of the UI:N claim deserves scrutiny: exploiting an archive parser normally requires a victim to receive and open (or preview/extract) a malicious compressed file, which in practice implies user interaction (UI:R) and functionally behaves like a file-delivery bug rather than a fully server-side network service flaw. EPSS is not provided, KEV status is not listed, and no public POC is referenced, so despite the ceiling severity there is currently no evidence of active or widespread exploitation - this reads as a high-CVSS, patch-promptly issue rather than a confirmed emergency. The near-universal deployment footprint and Microsoft's own high rating argue for fast patching regardless of the UI nuance. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted .zip archive whose internal metadata is malformed to overflow the Compressed Folder parser's heap buffer; when the victim opens or extracts the archive using the built-in Windows handler, the corruption is triggered and attacker-supplied code runs in the victim's context. No public POC is currently identified, and the low attack complexity means a reliable exploit, if developed, would work against default Windows configurations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the Microsoft security update for CVE-2026-69496 via the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69496), installing at least the fixed build for each SKU: 6.2.9200.26349 (Server 2012), 6.3.9600.23397 (Server 2012 R2), 10.0.14393.9512 (2016/1607), 10.0.17763.9245 (1809/2019), 10.0.19044.7725 / 10.0.19045.7725 (Win10 21H2/22H2), 10.0.20348.5622 (Server 2022), 10.0.22631.7582 (Win11 23H2), 10.0.26100.9445 / 33438 (24H2 / Server 2025), 10.0.26200.9445 (25H2), and 10.0.28000.2954 (26H1). Patch status: Patch available per vendor advisory (fixed builds enumerated per SKU above). Until updates are deployed, reduce exposure by blocking or quarantining inbound compressed archives at the mail/web gateway and by using Group Policy to associate .zip handling with a hardened third-party archiver instead of the built-in Compressed Folder handler - the trade-off is broken native double-click ZIP browsing and possible user workflow friction. User-awareness guidance not to open unexpected archives is a partial, non-technical compensating control only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the native Windows Compressed Folder feature (the Explorer shell extension, historically zipfldr.dll, that lets users browse and extract .zip archives without third-party tooling). CWE-122 (heap-based buffer overflow) indicates the parser allocates a heap buffer sized from attacker-influenced archive metadata (e.g., entry counts, name lengths, or size fields) and then writes past the allocation when the archive contents do not match the assumed bounds. Because this handler is present and enabled by default on every supported Windows SKU listed in the EUVD data - Windows Server 2012/2012 R2/2016/2019/2022/2025 (including Server Core) and Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1 - the exposed code path is effectively universal across the Windows fleet.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated and network-delivered, but exploiting the Compressed Folder parser realistically requires the victim to open/extract a crafted archive, so UI:R rather than the vendor's UI:N; full RCE impact justifies C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical remote code execution vulnerability in Windows' built-in ZIP file handler affects all supported Windows client and server platforms, enabling attackers to gain system-level control by delivering malicious compressed archives. This flaw impacts organizational infrastructure from client workstations through server deployments, creating immediate risk across endpoints that routinely receive files via email, web downloads, and network shares. Given the broad platform coverage and CVSS 9.8 severity, this represents a top-priority patching requirement for IT operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB