CVE-2024-20696 Windows libarchive Remote Code Execution Vulnerability
An attacker can execute arbitrary code on Windows systems by exploiting a heap-based buffer overflow in the libarchive component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-20696?
CVE-2024-20696 is a high-severity memory corruption vulnerability in Microsoft Windows 10 1809, published on 9 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Windows libarchive Remote Code Execution Vulnerability
Weakness: CWE-122
Which versions are affected by CVE-2024-20696?
It affects 9 products.
Linux distribution packages (26)
libarchive SUSE:Enterprise Storage 7.1 | All versions | 3.4.2-150200.4.18.1 |
libarchive SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.4.2-150200.4.18.1 |
libarchive SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.4.2-150200.4.18.1 |
libarchive SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Micro 5.3 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Micro 5.4 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Micro 5.5 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Micro 5.5 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Module for Development Tools 15 SP5 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.3.3-32.11.1 |
libarchive SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 3.4.2-150200.4.18.1 |
libarchive SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 3.4.2-150200.4.18.1 |
libarchive SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.3.3-32.11.1 |
libarchive SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 3.4.2-150200.4.18.1 |
libarchive SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 3.4.2-150200.4.18.1 |
libarchive SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.3.3-32.11.1 |
libarchive SUSE:Manager Proxy 4.3 | All versions | 3.5.1-150400.3.15.1 |
libarchive SUSE:Manager Server 4.3 | All versions | 3.5.1-150400.3.15.1 |
libarchive openSUSE:Leap 15.5 | All versions | 3.5.1-150400.3.15.1 |
libarchive openSUSE:Leap Micro 5.3 | All versions | 3.5.1-150400.3.15.1 |
libarchive openSUSE:Leap Micro 5.4 | All versions | 3.5.1-150400.3.15.1 |
libarchive openSUSE:Tumbleweed | All versions | 3.7.6-1.1 |
Products include Microsoft Windows 10 1809, Microsoft Windows 10 21h2, Microsoft Windows 10 22h2, Microsoft Windows 11 21h2, Microsoft Windows 11 22h2, Microsoft Windows 11 23h2 and 3 more.
How do I fix CVE-2024-20696?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-20696 being exploited?
There is no known exploitation of CVE-2024-20696 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Windows 10 1809
- CVE-2024-29988 Microsoft SmartScreen Prompt Security Feature Bypass
- CVE-2024-21412 Microsoft Windows Internet Shortcut Files Security Feature Bypass
- CVE-2025-62221 Microsoft Windows Use After Free
- CVE-2025-30400 Microsoft Windows DWM Core Library Use-After-Free
- CVE-2024-21338 Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control
Sources
Also known as ALPINE-CVE-2024-20696, CLSA-2026-1775647149, CLSA-2026-1775689506, DEBIAN-CVE-2024-20696, DSA-5806-1, GHSA-g5xc-jv8h-2232 and 9 more.