Windows Libarchive contains a path‑traversal flaw that permits an attacker with the ability to supply a malicious archive to write files outside the intended directory. The flaw can be used to tamper with files that the vulnerable component can create or modify, potentially affecting system or application data. The weakness corresponds to CWE‑22, improper limitation of a pathname to a restricted directory.

The vulnerability affects multiple Microsoft Windows releases. On Windows 10 it applies to versions 1809, 21H2 and 22H2. On Windows 11 it applies to versions 23H2, 24H2, 25H2, 26H2 and 26H1 (including arm64 and x64). It also affects Windows Server 2019, Server Core; Windows Server 2022; and Windows Server 2025 (both standard and Server Core). Any installation that includes the affected Libarchive component is vulnerable until addressed.

The CVSS score of 6.5 classifies the vulnerability as moderate. The EPSS score is less than 1 %, indicating a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalogue, so no confirmed large‑scale exploitation is reported. The likely attack surface is remote, as the description notes that an unauthorized attacker can tamper over a network. An attacker would need to supply malicious input to an archive‑processing routine that accepts unauthenticated network data, and exploit the path‑validation failure to write to arbitrary locations.