CVE-2024-20697
Windows libarchive Remote Code Execution Vulnerability
7.3 High
Windows libarchive Remote Code Execution Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
72.2%Up 72.1 points since Jan 18, 2024
What each source reports
CVE List Score used
Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
- Record
CVE-2024-20697- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2024-18412
Windows libarchive Remote Code Execution Vulnerability
- Record
EUVD-2024-18412- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w6xv-37jv-7cjr
Windows Libarchive Remote Code Execution Vulnerability
Windows Libarchive Remote Code Execution Vulnerability
- Record
GHSA-w6xv-37jv-7cjr- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
NVD
Windows libarchive Remote Code Execution Vulnerability
- Record
CVE-2024-20697- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVSUSE-SU-2024:2083-1 No score
Security update for libarchive
This update for libarchive fixes the following issues:
- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (bsc#1225972).
- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).
- Record
SUSE-SU-2024:2083-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:3940-1 No score
Security update for libarchive
This update for libarchive fixes the following issues:
- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (bsc#1225972).
- CVE-2024-48958: Fixed out-of-bounds access via a crafted archive file in execute_filter_delta function (bsc#1231624).
- Record
SUSE-SU-2024:3940-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20050-1 No score
Security update for libarchive
This update for libarchive fixes the following issues:
- CVE-2024-20696: Fixed out-of-bounds access in in copy_from_lzss_window_to_unp() (bsc#1225971)
- CVE-2024-20697: Fixed heap based buffer overflow in rar e8 filter (bsc#1225972)
- Record
SUSE-SU-2025:20050-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20087-1 No score
Security update for libarchive
This update for libarchive fixes the following issues:
- CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624).
- CVE-2024-20697: Fixed out-of-bounds remote code execution vulnerability (bsc#1225972).
- CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544).
- Record
SUSE-SU-2025:20087-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:20257-1 No score
Security update for libarchive
This update for libarchive fixes the following issues:
- CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)
- CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)
- CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)
- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)
- CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)
- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)
- Record
SUSE-SU-2025:20257-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libarchiveSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs |
before 3.7.2-150600.3.3.1 | 3.7.2-150600.3.3.1 |
libarchiveSUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 2 CVEs |
before 3.7.2-150600.3.3.1 | 3.7.2-150600.3.3.1 |
libarchiveopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 3.7.2-150600.3.3.1 | 3.7.2-150600.3.3.1 |
libarchiveSUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 2 CVEs |
before 3.7.2-150600.3.9.1 | 3.7.2-150600.3.9.1 |
libarchiveSUSE:Linux Enterprise Module for Development Tools 15 SP6 From an advisory covering 2 CVEs |
before 3.7.2-150600.3.9.1 | 3.7.2-150600.3.9.1 |
libarchiveopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 3.7.2-150600.3.9.1 | 3.7.2-150600.3.9.1 |
libarchiveSUSE:Linux Micro 6.0 From an advisory covering 2 CVEs |
before 3.6.2-3.1 | 3.6.2-3.1 |
libarchiveSUSE:Linux Micro 6.0 From an advisory covering 4 CVEs |
before 3.6.2-4.1 | 3.6.2-4.1 |
libarchiveSUSE:Linux Micro 6.1 From an advisory covering 7 CVEs |
before 3.7.4-slfo.1.1_2.1 | 3.7.4-slfo.1.1_2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-20697 is a high vulnerability (CVSS 7.3) in Microsoft Windows 11 Version 22h2, published January 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 72.2%, the 99th percentile. No source names a fixed version.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20697
zerodayinitiative.com/blog/2024/4/17/cve-2024-20697-windows-libarchive-remote-code-execution-vulnerability
github.com/advisories/GHSA-w6xv-37jv-7cjr
openwall.com/lists/oss-security/2024/06/05/1
nvd.nist.gov/vuln/detail/CVE-2024-20697
Show 18 moreShow less
suse.com/support/update/announcement/2024/suse-su-20242083-1
bugzilla.suse.com/1225971