WinRAR vulnerabilities

6 known vulnerabilities in WinRAR from Rarlab. 6 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  WinRAR: Improper Validation of Array Index

  CVE-2026-14191Jul 1, 2026Rarlab

  An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an indepen

• 7.8 High severity

  RARLAB WinRAR Path Traversal Exploited

  CVE-2025-6218Jun 21, 2025RarlabEPSS 90.5%

  RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the targe

• 7.8 High severity

  WinRAR: Improper Validation of Array Index

  CVE-2023-40477May 3, 2024RarlabEPSS 10%

  RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this

• 7.1 High severity

  winrar: Improper Neutralization of Escape, Meta, or Control Sequences

  CVE-2024-33899Apr 29, 2024Rarlab

  RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.

• 7.8 High severity

  RARLAB WinRAR Code Execution Exploited

  CVE-2023-38831Aug 23, 2023RarlabEPSS 99.8%

  RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has th

• 7.1 High severity

  WinRAR: Out-of-bounds Read

  CVE-2022-43650Mar 29, 2023RarlabEPSS 23.2%

  This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file