Threat database

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.

A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Such manipulation leads to path traversal. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.20 build 128 is able to mitigate this issue. You should upgrade the affected component. The vendor responded very professional: "This is the real vulnerability affecting RAR for Android only. WinRAR and Unix RAR versions are not affected. We already fixed it in RAR for Android 7.20 build 128 and we publicly mentioned it in that version changelog. (...) To avoid confusion among users, it would be useful if such disclosure emphasizes that it is RAR for Android only issue and WinRAR isn't affected."

EPSS 0.6%VulnerabilityRarlabGermanyFrance+6

CVE-2025-6218 is a high-severity path traversal vulnerability in RARLAB WinRAR version 7.11 (64-bit) that allows remote attackers to execute arbitrary code. The flaw exists in the handling of file paths within archive files, enabling crafted paths to traverse directories improperly. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability permits code execution with the privileges of the current user.

RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.

EPSS 11%VulnerabilityRARLAB#cwe-129Germany+9

RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The specific flaw exists within the archive extraction functionality. A crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user. Was ZDI-CAN-23156.

EPSS 1.2%VulnerabilityRARLAB#cwe-693United States+9

CVE-2023-38831 is a high-severity remote code execution vulnerability affecting WinRAR versions prior to 6.23. The flaw allows an attacker to execute malicious code when a user opens a specially crafted ZIP archive containing a benign file and a folder with the same name. Exploitation requires user interaction but no privileges or authentication. This vulnerability was actively exploited in the wild from April to October 2023. The CVSS score of 7.8 reflects significant impact on confidentiality, integrity, and availability. European organizations using vulnerable WinRAR versions, especially those processing ZIP files from untrusted sources, are at risk. Mitigation involves updating WinRAR to version 6.23 or later and implementing strict archive handling policies.

KEVEPSS 99%VulnerabilityRARLABGermanyFrance+8

RARLAB UnRAR on Linux and UNIX platforms contains a directory traversal vulnerability that allows attackers to write files outside the intended extraction directory during unpack operations. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution