UnRAR vulnerabilities

3 known vulnerabilities in UnRAR from Rarlab. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  WinRAR: Improper Validation of Array Index

  CVE-2026-14191Jul 1, 2026Rarlab

  An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an indepen

• 7.1 High severity

  winrar: Improper Neutralization of Escape, Meta, or Control Sequences

  CVE-2024-33899Apr 29, 2024Rarlab

  RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.

• 7.5 High severity

  RARLAB UnRAR Directory Traversal Exploited

  CVE-2022-30333May 9, 2022RarlabEPSS 99.2%

  RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.