Microsoft Windows libarchive: Heap-based buffer overflow allows remote code execution

Summary

A heap-based buffer overflow in the libarchive component of Windows allows an unauthenticated remote attacker to execute code. The attack requires that a user interacts with the flaw (UI:R in the CVSS vector), for example by opening a crafted archive. Whether a Windows network service parses archives automatically is unknown.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H1 and 26H2: see the vendor advisory for the exact builds
• Windows Server 2022: builds 10.0.20348.0 to below 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds 10.0.26100.0 to below 10.0.26100.33650

Fixed in

• Install the October 2026 Windows security update for your edition (for Windows 10 1809 and Server 2019 the update is listed as KB5126651 by a third-party source; verify in the MSRC advisory)
• Fixed builds: 10.0.17763.9376 (1809, Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.20348.5761 (Server 2022), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26100.33650 (Server 2025)
• Reboot after installation

Workaround

• Unknown. The vendor has not published a workaround in the sources reviewed.
• If patching is not possible, one third-party source recommends blocking or restricting processing of untrusted archives by the affected component; full steps could not be verified.

Exploitation

• CISA SSVC: exploitation none, not automatable, technical impact total
• Microsoft: not publicly disclosed, not exploited, exploit code maturity Unproven
• Not in the CISA KEV catalog
• No public proof-of-concept found in the searches performed; this is not a confirmation of absence
• EPSS below 1 percent

Our recommendation

• Identify all Windows 10 1809, Windows Server 2019 and other affected systems and install the October 2026 security update in the normal patch cycle.
• Prioritise file servers and hosts that receive archives from email, web downloads or external sources.
• Restrict or monitor the handling of untrusted archives where patching is delayed.
• Verify the support status of Windows 10 1809 (for example LTSC) and plan upgrades.
• Track the correct CVE ID; CVE-2026-69639 is a similarly titled libarchive issue with a different score.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69985 msrc.microsoft.com
• OpenCVE: CVE-2026-69985 app.opencve.io
• Vulners NVD: CVE-2026-69985 vulners.com
• Vulners Vulnrichment: CVE-2026-69985 vulners.com
• Tenable Nessus plugin 365475 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:02.