CVE-2024-38165 Overview
CVE-2024-38165 is a tampering vulnerability affecting the Windows Compressed Folder feature in Microsoft Windows 11 22H2 and 23H2. The flaw is categorized under [CWE-73] (External Control of File Name or Path) and allows an attacker to manipulate compressed archive contents to affect integrity on a target system. Exploitation requires user interaction, such as opening a crafted archive delivered through phishing or a malicious website. Successful exploitation impacts data integrity without directly disclosing information or causing a denial of service.
Critical Impact
An attacker who convinces a user to open a specially crafted compressed folder can tamper with file paths or contents, potentially overwriting arbitrary files the user can write to.
Affected Products
- Microsoft Windows 11 22H2
- Microsoft Windows 11 23H2
- Windows Compressed Folder component
Discovery Timeline
- 2024-08-13 - CVE-2024-38165 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-38165
Vulnerability Analysis
The vulnerability resides in how the Windows Compressed Folder feature processes file names and paths within archive files. An attacker crafts an archive containing entries with manipulated path metadata. When a user extracts or interacts with the archive, the Compressed Folder handler resolves those paths in a way that permits writing outside the intended extraction directory or altering existing files.
The issue is tracked under [CWE-73], which covers external control of file name or path. This class of flaw commonly enables path traversal or file overwrite scenarios during archive handling. The vulnerability affects integrity only; confidentiality and availability are not directly impacted according to the CVSS vector.
Exploitation requires user interaction and network delivery, typically through email attachments, web downloads, or shared network folders. No elevated privileges are required by the attacker to craft the malicious archive.
Root Cause
The root cause is improper validation of file path metadata within compressed archives handled by the Windows shell's built-in Compressed Folder feature. The handler does not sufficiently canonicalize or restrict entries containing traversal sequences or absolute path components, allowing content to be written outside the target extraction directory.
Attack Vector
An attacker delivers a crafted .zip or similar compressed archive to a targeted user. The user opens or extracts the archive using the built-in Windows Compressed Folder feature. The extraction process writes files to locations chosen by the attacker rather than the intended folder, enabling tampering with existing files or placement of malicious content in sensitive locations.
The vulnerability manifests during archive extraction. Refer to the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2024-38165
Indicators of Compromise
- Unexpected files appearing in system directories, startup folders, or user profile paths after archive extraction
- Compressed archives received from untrusted sources containing entries with ..\ traversal sequences or absolute paths
- Modification timestamps on system or application files that correlate with recent archive extraction activity
Detection Strategies
- Inspect email gateways and web proxies for compressed archives containing suspicious path metadata prior to delivery
- Monitor explorer.exe and related shell processes for file writes to paths outside the user-selected extraction directory
- Correlate archive open events with subsequent file creation events in sensitive locations such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Monitoring Recommendations
- Enable Windows file system auditing on high-value directories to capture unauthorized writes
- Log and alert on process chains where explorer.exe writes executable or script files following user download activity
- Track EPSS trends for CVE-2024-38165; the current EPSS score is 1.328% at the 69.4 percentile
How to Mitigate CVE-2024-38165
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for Windows 11 22H2 and 23H2
- Instruct users to avoid opening compressed archives from untrusted sources until systems are patched
- Verify that automated patch deployment pipelines include the August 2024 Windows cumulative update
Patch Information
Microsoft addressed CVE-2024-38165 in the August 2024 security update cycle. Consult the Microsoft Security Update Guide for the specific KB article and build numbers applicable to affected Windows 11 22H2 and 23H2 installations.
Workarounds
- Use a third-party archive utility configured to sanitize path traversal entries when handling untrusted archives
- Extract untrusted archives inside an isolated sandbox or virtual machine before moving contents to production systems
- Block delivery of compressed archives from external senders at the mail gateway when business requirements permit
# Verify installed Windows build to confirm patch level
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
# List recently installed updates
wmic qfe list brief /format:table
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
