The vulnerability is a relative path traversal flaw in Windows Libarchive that permits an attacker with network access to tamper with files on the system. This weakness allows modification, deletion, or injection of files by supplying malicious archive paths, leading to integrity compromise of system files or application data. The flaw follows CWE-23.

Affected systems include Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 version 26H1, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation).

The CVSS base score is 6.5, indicating a medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so there are no known active exploits at this time. The attack vector is likely over a network to a system running the vulnerable Libarchive component, so any machine with exposed archive handling functionality could be targeted. Proper configuration and patching are therefore critical.