Windows Compressed Folder EUVD-2026-73508

Exploitation requires a local authenticated user account with at minimum standard (low-privilege) rights on the target Windows system, consistent with the CVSS PR:L metric. The attacker must be able to place a crafted ZIP file on the target and trigger extraction through the Windows Compressed Folder feature, which is enabled by default on all affected Windows editions - no non-default configuration is required. No user interaction beyond the attacker's own actions is needed (UI:N). The primary limiting factor is the requirement for prior local access (AV:L): remote-only attackers cannot exploit this directly and must first achieve local foothold via another vector. Windows Server Core installations are also listed as affected, meaning GUI-less deployments are not protected. Windows Server 2012 and 2012 R2 (both listed) are end-of-life platforms that may not receive standard patches without an extended security update subscription.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, reflecting a local, low-complexity attack requiring only standard user privileges with no user interaction needed. The full C:H/I:H/A:H impact triple is consistent with successful local privilege escalation to SYSTEM, which grants complete control over the host. No CISA KEV listing and no public POC have been identified, which partially dampens urgency relative to raw CVSS score. However, the AC:L/PR:L/UI:N combination means that once an attacker has any foothold on a Windows endpoint - through phishing, stolen credentials, or another initial access vector - this becomes a reliable, scripted privilege escalation step requiring no special knowledge. The extremely broad affected version surface (19 distinct Windows product/version combinations from Server 2012 to Windows 11 26H1) means virtually every unpatched Windows environment is exposed. EPSS data was not provided; without it, exploitation probability cannot be quantified beyond CVSS signal.

An attacker with a standard domain or local user account on a Windows workstation crafts a ZIP archive containing a file with a traversal path such as '../../Windows/System32/WindowsPowerShell/v1.0/malicious.dll', then triggers extraction using the built-in Windows Compressed Folder handler. The crafted file lands in a privileged system directory and is subsequently loaded by a high-privilege process, elevating the attacker to SYSTEM. No public proof-of-concept code has been identified at time of analysis, but this zip-slip pattern is well-understood and exploit development would be straightforward given the low complexity rating.