CVE-2024-20697: Windows libarchive heap buffer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityHigh CVSS (7.3) and very high EPSS (99.4th percentile) indicate meaningful risk, though local access and user interaction reduce ease of exploitation.

What it is

CVE-2024-20697 is a heap-based buffer overflow in Windows libarchive, the library Windows uses to handle archive formats. A crafted archive can corrupt heap memory and lead to code execution in the context of the affected process. Microsoft rates it high severity, and the flaw affects Windows 11 22H2/23H2 and Windows Server 2022 23H2.

Impact

An attacker who gets a victim to open a malicious archive can execute code with the privileges of the process handling it, giving full compromise of confidentiality, integrity and availability within that context.

Attack surface

The CVSS vector is local (AV:L) with low privileges (PR:L) and required user interaction (UI:R), so the attacker must already have a foothold on the host and convince a user to open a crafted archive. It is not remotely reachable without that local access and user action.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.72163 (99.4th percentile), indicating elevated predicted exploitation activity. References include a vendor patch and a Zero Day Initiative write-up, but no public exploit is confirmed in the record.

What to do

• Apply the Microsoft update for CVE-2024-20697 on all affected Windows 11 22H2/23H2 and Windows Server 2022 23H2 systems.
• Restrict which users and processes can open untrusted archive files, and block archive attachments at email and web gateways where feasible.
• Run archive-handling and extraction tasks with least privilege and in sandboxed or isolated contexts.
• Monitor for and remove unnecessary software that parses archives using the affected libarchive component.

Detection

• Alert on processes that load libarchive-related DLLs and then spawn child processes or make unexpected network connections.
• Hunt for archive files written to disk shortly before crashes or anomalous process behavior in Windows Error Reporting and endpoint telemetry.
• Correlate user opening of archive attachments from email or downloads with subsequent suspicious process creation on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.