Microsoft Windows: Double free in libarchive allows remote code execution

Summary

Microsoft's October 2026 update fixes a double free (CWE-415) in the Windows libarchive component. According to the CVE record, an unauthenticated attacker on the network can execute code without user interaction, but attack complexity is high. Microsoft rates the flaw CVSS 8.1 and lists affected builds for Windows 10, Windows 11 and Windows Server. No exploitation and no public proof of concept have been found.

Affected

• Windows 10 Version 1809 (builds below 10.0.17763.9376)- Windows 10 Version 21H2 (below 10.0.19044.7807); Version 22H2 (below 10.0.19045.7807)- Windows 11 Version 23H2 (below 10.0.22631.7652); Version 24H2 (below 10.0.26100.9711); Version 25H2 (below 10.0.26200.9711); Version 26H1 (below 10.0.28000.3231); Version 26H2 (below 10.0.26300.9711)- Windows Server 2019, including Server Core (below 10.0.17763.9376); Server 2022 (below 10.0.20348.5761); Server 2025, including Server Core (below 10.0.26100.33650)

Fixed in

• Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later (per CNA record; verify on the MSRC page)- Other versions: the builds listed under affected or later, as published by Microsoft- Patch package reported as KB5126651 (Windows 10 1809 / Server 2019 Security Update, October 2026); confirm on the MSRC page

Workaround

Unknown. No vendor workaround or interim mitigation has been identified; applying the security update is the remedy.

Exploitation

• No evidence of exploitation in the wild found- CISA SSVC: exploitation none, automatable no, technical impact total- EPSS score 0.00695 at time of retrieval- No public proof of concept found; status is not known rather than confirmed absent

Our recommendation

• Install the October 2026 Microsoft security update on all affected Windows 10, 11 and Server systems, starting with Windows 10 1809 and Server 2019 systems- Check the Microsoft lifecycle page: Windows 10 1809 Home and Pro editions are out of support, and only LTSC editions remain supported- Inventory all Windows systems and verify builds after patching- Identify whether systems use libarchive-based features (for example the tar tool) and whether they are reachable from untrusted networks- Monitor for exploitation indicators and new public proof-of-concept code

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70062 msrc.microsoft.com
• Zero Day Initiative: The October 2026 Security Update Review www.zerodayinitiative.com
• CVE record mirror (CNA JSON) via Vulners vulners.com
• NVD entry mirror via Vulners vulners.com
• OpenCVE: CVE-2026-70062 app.opencve.io
• Rapid7 entry (EPSS) via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:34.