CVE-2024-43495
Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
- Record
CVE-2024-43495- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2024-40754
Windows libarchive Remote Code Execution Vulnerability
- Record
EUVD-2024-40754- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5gvh-cqjm-hff8
Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
- Record
GHSA-5gvh-cqjm-hff8- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
Windows libarchive Remote Code Execution Vulnerability
- Record
CVE-2024-43495- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVOESA-2024-2170
libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .
Security Fix(es):
Windows libarchive Remote Code Execution Vulnerability(CVE-2024-43495)
- Record
OESA-2024-2170- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libarchiveopenEuler:24.03-LTS |
before 3.7.1-4.oe2403 | 3.7.1-4.oe2403 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-43495 is a high vulnerability (CVSS 7.3) in Microsoft Windows 11 Version 22h2, published September 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in libarchive 3.7.1-4.oe2403.