Rarlab vulnerabilities
We track 8 vulnerabilities in Rarlab products across 5 products. 8 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on July 1, 2026.
Latest Rarlab vulnerabilities
- 7.8 High severity
WinRAR: Improper Validation of Array Index
An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an indepen
- 8.1 High severity
RAR App: Improper Limitation of a Pathname to a Restricted Directory
A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Such manipulation leads to path traversal. It is possible to launch the attack remotely. Attacks of this
- 7.8 High severity
RARLAB WinRAR Path Traversal Exploited
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the targe
- 7.8 High severity
WinRAR: Improper Validation of Array Index
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this
- 7.1 High severity
winrar: Improper Neutralization of Escape, Meta, or Control Sequences
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- 7.8 High severity
RARLAB WinRAR Code Execution Exploited
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has th
- 7.1 High severity
WinRAR: Out-of-bounds Read
This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file
- 7.5 High severity
RARLAB UnRAR Directory Traversal Exploited
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.