CVE-2026-14191: CWE-787 Out-of-bounds Write in RARLAB WinRAR
CVE-2026-14191 is a high-severity out-of-bounds heap write vulnerability in the RAR5 recovery-volume (.rev) parser of WinRAR and UnRAR. It occurs when processing multiple .rev files in a set, allowing an attacker to corrupt adjacent heap objects by writing beyond the allocated buffer. Exploitation requires the victim to run a recovery or test operation on a crafted .rev file set. This vulnerability is fixed in WinRAR / RAR version 7.23.
AI Analysis
Technical Summary
This vulnerability involves an out-of-bounds heap write in the RecVolumes5::ReadHeader function within recvol5.cpp of WinRAR and UnRAR. The RecItems vector is sized only when the first .rev file is processed, but subsequent .rev files provide a RecNum value validated only against their own TotalCount field, not against the actual size of RecItems. This allows an attacker to write a controlled 32-bit value (RevCRC field) at an offset up to 65534 times the size of RecVolItem beyond the allocated buffer, corrupting adjacent heap memory. Triggering requires running recovery or test operations on attacker-supplied .rev files. This issue affects the RAR5 path and is related to a previously fixed RAR3 path vulnerability (CVE-2023-40477). The vulnerability is fixed in WinRAR / RAR version 7.23.
Potential Impact
Successful exploitation can lead to heap corruption, potentially resulting in arbitrary code execution, denial of service, or data corruption. The vulnerability requires local access to run recovery or test operations on malicious .rev files, and user interaction is needed to trigger it. The CVSS 3.1 base score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in WinRAR / RAR version 7.23. Users and administrators should upgrade to version 7.23 or later to remediate this vulnerability. No official vendor advisory content was provided, but the description explicitly states the issue is fixed in 7.23. Until patched, avoid running recovery or test operations on untrusted .rev files.
CVE-2026-14191: CWE-787 Out-of-bounds Write in RARLAB WinRAR
Description
CVE-2026-14191 is a high-severity out-of-bounds heap write vulnerability in the RAR5 recovery-volume (.rev) parser of WinRAR and UnRAR. It occurs when processing multiple .rev files in a set, allowing an attacker to corrupt adjacent heap objects by writing beyond the allocated buffer. Exploitation requires the victim to run a recovery or test operation on a crafted .rev file set. This vulnerability is fixed in WinRAR / RAR version 7.23.
CVSS v3.1
Score 7.8high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves an out-of-bounds heap write in the RecVolumes5::ReadHeader function within recvol5.cpp of WinRAR and UnRAR. The RecItems vector is sized only when the first .rev file is processed, but subsequent .rev files provide a RecNum value validated only against their own TotalCount field, not against the actual size of RecItems. This allows an attacker to write a controlled 32-bit value (RevCRC field) at an offset up to 65534 times the size of RecVolItem beyond the allocated buffer, corrupting adjacent heap memory. Triggering requires running recovery or test operations on attacker-supplied .rev files. This issue affects the RAR5 path and is related to a previously fixed RAR3 path vulnerability (CVE-2023-40477). The vulnerability is fixed in WinRAR / RAR version 7.23.
Potential Impact
Successful exploitation can lead to heap corruption, potentially resulting in arbitrary code execution, denial of service, or data corruption. The vulnerability requires local access to run recovery or test operations on malicious .rev files, and user interaction is needed to trigger it. The CVSS 3.1 base score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in WinRAR / RAR version 7.23. Users and administrators should upgrade to version 7.23 or later to remediate this vulnerability. No official vendor advisory content was provided, but the description explicitly states the issue is fixed in 7.23. Until patched, avoid running recovery or test operations on untrusted .rev files.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- securin
- Date Reserved
- 2026-06-30T08:32:07.249Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a448b4d27e9c79719e6c5dd
Added to database: 07/01/2026, 03:36:45 UTC
Last enriched: 07/01/2026, 03:51:22 UTC
Last updated: 07/01/2026, 04:12:20 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.