CVE-2024-20697

What it actually does

This vulnerability is a remote code execution flaw in the Windows Libarchive component used to process archive files. Although categorized as remote code execution, the CVSS vector indicates exploitation requires local access privileges and user interaction: an authenticated low-privileged attacker must cause a user or process to open or process a specially crafted archive. Successful exploitation can execute attacker-controlled code in the context of the affected user or calling process, potentially allowing data theft, file modification, malware execution, and further local escalation or lateral movement depending on available privileges.

Why it matters to the business

An attacker who convinces a user to open a malicious archive can run code on affected Windows 11 or Windows Server 2022 systems, creating risk of workstation compromise, credential theft, malware deployment, and disruption to business operations. The EPSS score is high, indicating a materially elevated likelihood of exploitation activity even though the vulnerability is not listed in CISA KEV and no mature public exploit is noted in the provided data. Organizations with affected Windows desktop or server populations should prioritize patch verification and monitoring for suspicious archive-delivery activity.

How an attack unfolds

An attacker prepares a malicious archive designed to trigger the Libarchive flaw when Windows processes it. The archive may be delivered through phishing email, file-sharing links, collaboration platforms, removable media, or another foothold where the attacker can place a file accessible to a victim. Exploitation requires a user action or an application workflow that opens, previews, extracts, indexes, scans, or otherwise parses the crafted archive on an affected Windows 11 22H2, Windows 11 23H2, or Windows Server 2022 23H2 system. If parsing succeeds, the attacker's code runs under the privileges of the user or process handling the file. From there, the attacker may establish persistence, steal credentials or sensitive files, execute additional payloads, and attempt privilege escalation or lateral movement.

How to fix it

Apply the relevant Microsoft security updates for CVE-2024-20697 to all affected Windows 11 22H2, Windows 11 23H2, and Windows Server 2022 23H2 systems. Because no exact fixed build numbers were provided, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch management tooling to confirm the January 2024 or later cumulative security update applicable to each OS version is installed. Until patching is complete, reduce exposure by blocking or quarantining unexpected archive attachments, disabling automatic processing of untrusted archives where feasible, preventing archive extraction from untrusted locations, enforcing least privilege, and using endpoint protection rules to detect suspicious child processes spawned from archive utilities, file explorers, mail clients, browsers, or collaboration applications.

How to confirm the fix worked

Confirm affected systems have installed the Microsoft cumulative security update that includes the fix for CVE-2024-20697 by checking Windows Update history, enterprise patch compliance reports, or the Microsoft Security Update Guide mappings for each OS build. Validate that Windows 11 22H2, Windows 11 23H2, and Windows Server 2022 23H2 assets are no longer missing the relevant January 2024 or later security update. Perform a controlled scan with authenticated vulnerability assessment tools to confirm the CVE is no longer reported. Review endpoint telemetry to ensure archive files from untrusted sources are being scanned or blocked according to policy, and test that email/web security controls quarantine suspicious archive attachments where appropriate.

Typical attack path

1. Identify users or workflows likely to receive or process archive files on affected Windows systems.
2. Craft or obtain a malicious archive that targets the Windows Libarchive parsing vulnerability.
3. Deliver the archive through phishing, file-sharing, collaboration tools, web download, or by placing it on a network share accessible to the target.
4. Induce the victim or an automated process to open, preview, extract, scan, or index the archive.
5. Achieve code execution in the context of the affected user or process.
6. Run follow-on commands or payloads to collect credentials, stage malware, establish persistence, or move laterally.

How to detect it

Investigate whether untrusted archive files were opened or processed on affected Windows systems followed by unusual process execution, network connections, persistence creation, or credential-access behavior. Relevant log sources include endpoint detection and response telemetry, Windows Security logs, Sysmon logs, PowerShell logs, email gateway logs, web proxy logs, browser download history, file-share access logs, and Microsoft Defender for Endpoint advanced hunting data. Look for archive files arriving via email, web downloads, or collaboration tools and then being opened by Explorer, archive utilities, mail clients, browsers, or indexing/scanning processes shortly before suspicious child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or wget.exe. Also search for newly created executables or scripts in user-writable directories, unexpected scheduled tasks, Run-key persistence, anomalous outbound connections, and credential dumping or discovery commands after archive interaction. Because no unique public exploit artifact was provided, detection should focus on behavioral chains: archive delivery or extraction followed by code execution and post-exploitation activity.

• cmd.exe spawned by explorer.exe after archive extraction
• powershell.exe spawned by explorer.exe after archive extraction
• wscript.exe spawned by explorer.exe after archive extraction
• cscript.exe spawned by explorer.exe after archive extraction
• mshta.exe spawned by explorer.exe after archive extraction
• rundll32.exe spawned by explorer.exe after archive extraction
• regsvr32.exe spawned by explorer.exe after archive extraction
• certutil.exe spawned by explorer.exe after archive extraction
• bitsadmin.exe spawned by explorer.exe after archive extraction
• curl.exe spawned by explorer.exe after archive extraction
• wget.exe spawned by explorer.exe after archive extraction
• powershell.exe -enc
• powershell.exe -EncodedCommand
• schtasks.exe /create
• reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• %TEMP%\*.exe
• %TEMP%\*.ps1
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk

What your security team should do

• Prioritize patch verification for all affected Windows 11 22H2, Windows 11 23H2, and Windows Server 2022 23H2 systems due to the high EPSS likelihood score.
• Run authenticated vulnerability scans or patch-compliance queries to identify systems missing the Microsoft update that remediates this issue.
• Harden email, web, and collaboration controls to inspect or block suspicious archive files, especially password-protected or uncommon archive formats.
• Monitor endpoint telemetry for archive-processing applications spawning script interpreters, command shells, credential tools, or network utilities.
• Review recent phishing, download, and file-share activity for suspicious archive delivery attempts, particularly around and after the January 2024 disclosure window.
• Ensure users and high-risk teams are warned against opening unexpected archive files from external or untrusted sources.
• Apply least-privilege controls and endpoint attack surface reduction rules to limit the impact if exploitation occurs.