CVE-2024-26185
Published: 12 March 2024
Summary
CVE-2024-26185 is a medium-severity External Control of File Name or Path (CWE-73) vulnerability in Microsoft Windows 11 22H2. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Compressed Folder Tampering Vulnerability CVE-2024-26185 affects the handling of compressed folders in Windows. It carries a CVSS 6.5 rating reflecting network attack vector, low complexity, no required privileges, and required user interaction, resulting in high integrity impact without effects on confidentiality or availability. The issue is associated with CWE-73 external control of file name or path.
An unauthenticated remote attacker can exploit the flaw by supplying a crafted compressed folder that a user opens or interacts with, enabling tampering with file paths or contents on the target system.
Microsoft publishes mitigation guidance and patches through its Security Response Center advisory at the listed reference URL. The EPSS score has reached a peak of 0.1930 with a current value of 0.1889.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-23461
Vulnerability details
Windows Compressed Folder Tampering Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Rejects externally supplied file or resource identifiers that fail validity checks.