{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alibarchivelibarchivewindows/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:windows:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Libarchive (Windows implementation)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-69639 is a critical heap-based buffer overflow vulnerability residing in the Windows implementation of the Libarchive library. The vulnerability, which carries a CVSS base score of 9.8, permits an unauthenticated attacker to execute arbitrary code over a network by supplying a specially crafted archive file to an application that utilizes the affected library. Because Libarchive is widely integrated into various compression tools, backup solutions, and data processing utilities, the impact on organizational security is significant. Successful exploitation allows for complete system compromise within the context of the application process. Defenders should identify all applications running on Windows hosts that utilize the Libarchive library and monitor for patch availability from individual software vendors.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized remote code execution, which can lead to full system compromise, data exfiltration, or the installation of persistent malicious backdoors. Any Windows-based service or application that automatically processes external archive files via Libarchive is at high risk of exploitation. Given the prevalence of the library, the number of potentially affected products across enterprise environments is broad.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all internal and third-party software on Windows endpoints that utilize the Libarchive library by auditing software bills of materials (SBOM) or binary dependency scanning.\u003c/li\u003e\n\u003cli\u003eMonitor vendor security bulletins for updates addressing CVE-2026-69639, as Libarchive is often bundled as a static or dynamic dependency rather than a standalone operating system component.\u003c/li\u003e\n\u003cli\u003eEnsure that any software processing user-supplied archives is running with the principle of least privilege, specifically restricting the execution permissions of the service accounts used for archive decompression.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T20:38:49Z","date_published":"2026-10-13T20:38:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-libarchive-heap-overflow/","summary":"A heap-based buffer overflow vulnerability (CVE-2026-69639) in the Windows implementation of the Libarchive library enables unauthenticated remote code execution via malicious archive processing.","title":"Heap-based Buffer Overflow in Windows Libarchive (CVE-2026-69639)","url":"https://feed.craftedsignal.io/briefs/2026-10-libarchive-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:windows:*:*","version":"https://jsonfeed.org/version/1.1"}