A heap-based buffer overflow in the Windows libarchive component allows an attacker that can transmit data over the network to execute arbitrary code without user interaction. This flaw is a classic example of CWE-122 and can lead to full system compromise, including data theft, lateral movement, or ransomware deployment, as the attacker gains executable privileges on the affected machine.

Microsoft Windows 10 (Version 1809, 21H2, 22H2), Microsoft Windows 11 (Version 23H2, 24H2, 25H2, 26H2, 26H1), Microsoft Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). These versions are explicitly listed by the CNA as vulnerable.

The CVSS score of 8.8 classifies this vulnerability as high severity. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, indicating no public exploit has been reported to date. The vulnerability appears to be exploitable remotely via crafted archive files; the likely attack vector is inferred from the description that an unauthorized attacker can execute code over a network, suggesting that the attack requires network delivery of a malicious archive.