Windows Libarchive EUVD-2026-99122

Exploitation requires a victim to open or extract an attacker-supplied malicious archive using the Libarchive component bundled in Windows (UI:R) - it is not triggerable without that user action. The vulnerability is network-deliverable (the archive can be sent remotely) and requires no authentication or prior privileges on the target (PR:N), but the mandatory user interaction and the fact that it is not automatable (SSVC: Automatable=no) are the key limiting factors, confining realistic attacks to social-engineering or supply-of-file scenarios rather than unattended remote compromise. Impact is limited to integrity (file tampering/write outside intended path); there is no confidentiality or availability impact.

This is a medium-severity (CVSS 6.5) relative path traversal (CWE-23) in the Libarchive component shipped with Windows. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates network-reachable, low-complexity, unauthenticated exploitation but critically requires user interaction (UI:R) and yields only integrity impact (I:H) with no confidentiality or availability loss - consistent with an attacker overwriting/placing files outside the intended extraction directory when a victim processes a malicious archive. Multiple exploitation signals align toward LOWER real-world urgency: it is NOT listed in CISA KEV, no public POC is referenced, and CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial'. The SSVC 'not automatable' and UI:R requirement both argue against mass/wormable exploitation, pointing instead to targeted, social-engineering-dependent abuse. There is no conflict between the signals here - raw CVSS, SSVC, and the absence of KEV/POC all converge on a 'real but not emergency' patch-in-normal-cycle priority, elevated mainly by the enormous Windows install base rather than by active exploitation.

An attacker crafts a malicious archive (e.g., ZIP/TAR) containing entries with relative path traversal sequences and delivers it to a victim via email, download, or a shared location. When the victim extracts or processes the archive using the vulnerable Windows Libarchive component, files are written outside the intended directory, enabling tampering such as overwriting configuration or dropping files into sensitive paths. No public exploit code is identified at time of analysis, and successful attack depends on the victim actively processing the attacker-supplied archive (UI:R).