A heap-based buffer overflow in the Windows libarchive component permits an attacker that can send crafted input over the network to exploit the flaw and execute arbitrary code. The weakness, classified as CWE-122, compromises all affected Windows operating system images in which the vulnerable library is present, enabling the attacker to achieve full control of the targeted system with no authentication required. Because the vulnerability operates at the library level, any process that loads libarchive could be a potential entry point, producing a high impact on confidentiality, integrity, and availability.

Affected systems include Microsoft Windows 10 Version 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, Windows Server 2019, Windows Server 2022, Windows Server 2025 and their server core or ARM64 variants as enumerated in the CNA affected version list.

The CVSS base score of 9.8 denotes critical severity. The EPSS score of 0.79% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV database. Nevertheless, the description indicates an over-the-network exploit path, which suggests that remote attackers can trigger the overflow via network traffic. The low EPSS score does not diminish the risk to systems that are internet-facing or otherwise exposed to untrusted inputs that invoke libarchive.