This vulnerability involves an out-of-bounds heap write in the RecVolumes5::ReadHeader function within the RAR5 recovery-volume (.rev) parser of WinRAR and UnRAR. The issue arises because the RecItems vector is sized only when the first .rev file is processed, but subsequent .rev files use an independent RecNum value validated only against their own TotalCount field, not against the actual size of RecItems. An attacker can supply a crafted set of two or more .rev files to write an attacker-controlled 32-bit value (RevCRC field) to an out-of-bounds index in RecItems, corrupting adjacent heap memory. Triggering the vulnerability requires the victim to run a recovery or test operation on the malicious .rev set, such as using 'unrar t x.part1.rev', the WinRAR 'Repair archive' feature, or auto-recovery during extraction of a volume set with a missing .rar part. This vulnerability is related to CVE-2023-40477 but affects the RAR5 path, whereas the previous CVE affected the RAR3 path. The issue was fixed in WinRAR/RAR version 7.23.

Successful exploitation can lead to heap corruption, potentially allowing an attacker to execute arbitrary code, cause denial of service, or compromise the integrity and confidentiality of the affected system. The CVSS 3.1 score of 7.8 reflects high impact on confidentiality, integrity, and availability. Exploitation requires local access with user interaction (UI:R) and low attack complexity (AC:L).

A fix is available in WinRAR/RAR version 7.23. Users and administrators should update to version 7.23 or later to remediate this vulnerability. Until patched, avoid running recovery or test operations on untrusted or attacker-supplied .rev files. Patch status is not explicitly stated in the input beyond the fix version; verify with the vendor advisory for the latest remediation guidance.