CVE-2026-69973: Windows Libarchive Path Traversal Flaw

CVE-2026-69973 Overview

CVE-2026-69973 is a path traversal vulnerability in the Windows implementation of Libarchive, the open-source library used for reading and writing streaming archive formats. The flaw allows an unauthorized remote attacker to perform tampering operations against files outside the intended extraction directory. Exploitation requires user interaction, typically convincing a victim to open or process a crafted archive. The weakness is tracked as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Microsoft documented the issue in its Microsoft Security Update Advisory.

Critical Impact
A remote attacker can write or overwrite files outside the archive extraction root, enabling integrity compromise of system or application files without authentication.

Affected Products

Windows implementation of Libarchive
Windows components and applications that bundle or invoke Libarchive for archive extraction
Downstream software that relies on the vulnerable Libarchive code path on Windows

Discovery Timeline

2026-10-13 - CVE-2026-69973 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-69973

Vulnerability Analysis

The vulnerability resides in archive entry processing logic that fails to properly sanitize pathnames contained within archive files. When Libarchive on Windows extracts an archive, filenames embedded in archive headers are used to construct destination paths on disk. Insufficient validation of these pathnames allows traversal sequences to escape the intended extraction directory.

An attacker crafts an archive containing entries with filenames that include directory traversal elements or absolute path components. When a victim extracts the archive using an affected Libarchive consumer, files are written to attacker-chosen locations on the filesystem. The impact is scoped to integrity, with no direct confidentiality or availability loss indicated by the CVSS vector.

Because the attack surface is network reachable and requires only user interaction, delivery vectors include email attachments, web downloads, and shared network locations. Successful tampering can replace binaries, configuration files, scheduled task definitions, or startup items, enabling follow-on code execution under the privileges of a later-launching process.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Libarchive on Windows does not fully normalize or reject archive entries containing .. sequences, drive letters, UNC prefixes, or alternate path separators before writing extracted content to disk.

Attack Vector

Exploitation proceeds over the network with no privileges required but with user interaction. The attacker delivers a malicious archive, and extraction by any application using the vulnerable Libarchive component triggers file writes outside the extraction root. No authenticated session with the target system is needed.

No public proof-of-concept exploit is referenced in the advisory. Technical details are available in the Microsoft Security Update Advisory.

Detection Methods for CVE-2026-69973

Indicators of Compromise

Files created or modified outside the expected extraction directory shortly after an archive is opened by an archive utility or application.
Archive files containing entries whose names include ..\, ../, absolute paths, drive letters, or UNC prefixes.
Unexpected writes to Windows autorun locations, Startup folders, or %ProgramData% immediately following archive processing.

Detection Strategies

Inspect archive contents before extraction and flag entries with traversal sequences or absolute paths.
Correlate process execution of archive handlers with file creation events in sensitive directories outside user profiles.
Monitor endpoint telemetry for child processes spawned from files written during or just after archive extraction.

Monitoring Recommendations

Enable file integrity monitoring on system directories, startup paths, and application installation folders.
Log and alert on FileCreate and FileWrite events originating from archive-handling binaries that target paths outside expected working directories.
Review Windows Defender and third-party AV telemetry for archive-based delivery attempts and unusual extraction patterns.

How to Mitigate CVE-2026-69973

Immediate Actions Required

Apply the Microsoft security update referenced in the advisory to all affected Windows systems.
Inventory applications and build pipelines that bundle Libarchive on Windows and update them to patched versions.
Restrict handling of archives from untrusted sources until patching is complete.

Patch Information

Microsoft has published guidance and update availability through the Microsoft Security Update Advisory. Administrators should deploy the referenced update through Windows Update, WSUS, or their enterprise patch management workflow and verify version strings post-installation.

Workarounds

Block or quarantine inbound archive formats processed by Libarchive at the email and web gateway where feasible.
Extract untrusted archives inside isolated containers or sandboxed virtual machines with no write access to host paths.
Configure archive utilities to prompt or deny extraction when entries contain traversal sequences or absolute paths.

bash

# Configuration example
# Verify installed Windows updates on affected hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Scan a directory of archives for suspicious entry names using bsdtar
Get-ChildItem -Path .\archives\ -Filter *.zip | ForEach-Object {
    Write-Host "Inspecting $($_.FullName)"
    bsdtar -tf $_.FullName | Select-String -Pattern '\.\./|\.\.\\|^[A-Za-z]:|^\\\\'
}