CVE-2024-26185 Overview
CVE-2024-26185 is a tampering vulnerability in the Windows Compressed Folder feature affecting Microsoft Windows 11 22H2 and 23H2. The flaw is categorized under [CWE-73] (External Control of File Name or Path) and allows an attacker to compromise the integrity of files handled by the compressed folder subsystem. Successful exploitation requires user interaction, typically by opening a crafted archive delivered over the network. Microsoft addressed the issue through its Patch Tuesday update cycle in March 2024.
Critical Impact
An attacker who successfully exploits this vulnerability can tamper with files on the target system through a crafted compressed archive, undermining file integrity without requiring elevated privileges.
Affected Products
- Microsoft Windows 11 22H2
- Microsoft Windows 11 23H2
- Windows Compressed Folder component
Discovery Timeline
- 2024-03-12 - CVE-2024-26185 published to the National Vulnerability Database (NVD)
- 2024-03-12 - Microsoft published security update guidance for CVE-2024-26185
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-26185
Vulnerability Analysis
The vulnerability resides in the Windows Compressed Folder feature, the built-in ZIP archive handler shipped with Windows Explorer. The weakness is classified under [CWE-73], which covers external control of file names or paths. An attacker crafts a compressed archive whose internal structure influences file placement or naming during extraction or preview operations. This allows tampering with files that the user did not intend to modify.
Exploitation requires the victim to interact with the malicious archive, such as by opening or previewing it. No elevated privileges are needed on the target, and the attack can be delivered over the network through email attachments, web downloads, or shared file locations. The scope remains unchanged, meaning the impact stays within the security context of the invoking user.
Root Cause
The root cause is insufficient validation of file path components inside compressed archive entries. Windows Compressed Folder does not adequately restrict how entry names influence file operations. Attackers exploit this to overwrite or place files in unintended locations, breaking integrity guarantees for the affected user account.
Attack Vector
The attack vector is network-based. An attacker delivers a specially crafted archive file to a user through phishing, drive-by download, or a shared network location. When the user opens or extracts the archive using Windows Explorer's built-in Compressed Folder handler, tampering occurs. See the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2024-26185
Indicators of Compromise
- Presence of ZIP or compressed archive files containing entries with unusual path components, traversal sequences, or names that resolve outside the intended extraction directory.
- Unexpected file modifications in user profile directories immediately following the opening of an archive received via email or download.
- Windows Explorer processes (explorer.exe) writing to paths outside the archive extraction target during compressed folder operations.
Detection Strategies
- Inspect inbound archives at email and web gateways for entries whose logical paths deviate from the archive root.
- Correlate file-write events from explorer.exe with recent archive-open activity to surface anomalous extraction behavior.
- Alert on process telemetry that shows Windows Compressed Folder handling followed by writes to sensitive user or application data directories.
Monitoring Recommendations
- Enable Windows file system auditing on high-value directories under user profiles and application data paths.
- Ingest Sysmon FileCreate and ProcessCreate events to a central analytics platform for retrospective hunting.
- Track patch compliance status for Windows 11 22H2 and 23H2 endpoints to identify systems still exposed to CVE-2024-26185.
How to Mitigate CVE-2024-26185
Immediate Actions Required
- Apply the March 2024 Microsoft security update that addresses CVE-2024-26185 on all Windows 11 22H2 and 23H2 systems.
- Prioritize patching endpoints that routinely handle external archive files, such as user workstations and file servers.
- Verify update deployment status through Windows Update for Business, WSUS, or Microsoft Intune reporting.
Patch Information
Microsoft released a security patch through the Patch Tuesday cycle. Refer to the Microsoft Security Update Guide for CVE-2024-26185 for the applicable KB article and download links matching each Windows 11 build. Administrators should validate that the update installed successfully by reviewing the operating system build number after reboot.
Workarounds
- Block or quarantine compressed archive attachments at the email gateway when patching cannot be completed immediately.
- Instruct users to avoid opening archives from untrusted senders and to extract only through vetted third-party tools that enforce strict path validation.
- Restrict write permissions on sensitive directories to limit the blast radius of any tampering attempt originating from user-invoked processes.
# Verify installed KB updates on Windows 11 to confirm CVE-2024-26185 remediation
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2024-03-12') } | Sort-Object InstalledOn -Descending
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
