CVE-2026-69973

MediumCVSS 6.5/10Last modified Oct 16, 2026

Description

Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-699744.7Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally.CVE-2026-699767.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-699777.0Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.CVE-2026-699785.6Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally.CVE-2026-699795.5Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.CVE-2026-69982.4A vulnerability was detected in BDCOM P3310D 0.4.2 10.1.0F Build 86345. Affected is an unknown function of the component New RMON StatisticsCVE-2026-699825.9Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a netwCVE-2026-699847.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-699858.8Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.CVE-2026-699867.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-699877.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-699887.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-69973: Medium severity, CVSS 6.5 | Vulnix