Rarlab Winrar
30 CVEs affecting Rarlab Winrar. Latest disclosed: 2026-07-01. Critical: 0, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8088 | High | 8.8 | 2025-08-08 | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This… |
CVE-2026-14191 | High | 7.8 | 2026-07-01 | An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector… |
CVE-2025-6218 | High | 7.8 | 2025-06-21 | RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected install… |
CVE-2023-40477 | High | 7.8 | 2024-05-03 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2023-38831 | High | 7.8 | 2023-08-23 | RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because… |
CVE-2018-20253 | High | 7.8 | 2019-02-13 | In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats. Successful… |
CVE-2018-20252 | High | 7.8 | 2019-02-05 | In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful… |
CVE-2018-20250 | High | 7.8 | 2019-02-05 | In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When… |
CVE-2024-36052 | High | 7.5 | 2024-05-21 | RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899. |
CVE-2015-5663 | High | 7.4 | 2015-12-30 | The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extension… |
CVE-2024-33899 | High | 7.1 | 2024-04-29 | RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences. |
CVE-2022-43650 | High | 7.1 | 2023-03-29 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required… |
CVE-2025-31334 | Medium | 6.8 | 2025-04-03 | Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR v… |
CVE-2019-25677 | Medium | 6.2 | 2026-04-05 | WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in… |
CVE-2025-52331 | Medium | 6.1 | 2025-11-12 | Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the… |
CVE-2018-20251 | Medium | 5.5 | 2019-02-05 | In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNA… |
CVE-2024-30370 | Medium | 4.3 | 2024-04-02 | RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected i… |
CVE-2014-125119 | | 2025-07-25 | A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Dir… | |
CVE-2008-7144 | | 2009-09-01 | Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to crafted (1) ACE, (2) ARJ, (3) BZ2, (4) CAB… | |
CVE-2006-3912 | | 2006-07-28 | Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact. |