Windows Libarchive EUVD-2026-99093

Exploitation requires the target to process an attacker-crafted archive through the libarchive component bundled in Windows; the overflow occurs during parsing of malformed archive data (CWE-122 heap overflow). Per the vendor CVSS vector this requires no authentication (PR:N) and no user interaction (UI:N), implying a component or service that ingests archives automatically; in practice, limiting factors are whether such a network-exposed auto-processing path exists versus requiring a user to open the file. Affected builds are specific: all listed Windows 10 (1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025 versions below the patched build numbers; systems already updated to the fixed builds (e.g. 10.0.26100.9711 for 24H2) are not exploitable.

This is a genuine high-priority vulnerability, though not yet an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with total confidentiality, integrity and availability impact - the maximum-severity profile for a memory-corruption RCE. CISA's SSVC framework reinforces this: Technical Impact is 'total' and the issue is 'Automatable: yes', meaning an attacker could reliably script delivery across many targets. However, SSVC Exploitation is currently 'none', and the input provides no CISA KEV listing and no public proof-of-concept, so there is no public exploit identified at time of analysis and no evidence of in-the-wild use - the real-world threat today is lower than the 9.8 alone suggests. One signal to verify independently: heap overflows in libarchive are typically triggered by parsing a crafted archive, which in many deployments implies the victim opening/extracting a file (a user-interaction/local-delivery element), yet Microsoft's vector asserts AV:N/UI:N; defenders should confirm with the MSRC advisory whether a truly network-facing, no-interaction path exists (e.g. a service that auto-processes archives) versus the more common 'user opens malicious archive' case. Given the ubiquity of the affected platform and the 'Automatable: yes' rating, prioritize patching promptly despite the current absence of exploitation evidence.

An attacker crafts a malicious archive that triggers the heap-based buffer overflow when Windows' bundled libarchive parses it, corrupting heap memory to achieve arbitrary code execution. Delivery could occur via any Windows component or service that automatically processes archives, or by enticing a user to open the crafted file. No public exploit code or active exploitation is identified at time of analysis, but the SSVC 'Automatable: yes' rating indicates the attack could be reliably weaponized and scaled once an exploit is developed.