pwn.watch: RARLAB (WinRAR) incident updates

[high] RARLAB WinRAR: WinRAR Path Traversal Vulnerability

Tue, 09 Dec 2025 00:00:00 GMT

RARLAB WinRAR contains a path traversal vulnerability allowing an attacker to execute code in the context of the current user. Added to CISA KEV on 2025-12-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-12-09: CISA added CVE-2025-6218 to the KEV catalog (due 2025-12-30).

CVEs: CVE-2025-6218

[critical] RARLAB WinRAR: WinRAR Path Traversal Vulnerability

Tue, 12 Aug 2025 00:00:00 GMT

RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files. Added to CISA KEV on 2025-08-12.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-12: CISA added CVE-2025-8088 to the KEV catalog (due 2025-09-02).

CVEs: CVE-2025-8088

[high] WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)

Wed, 18 Oct 2023 00:00:00 GMT

WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.

Status: closed · Patch: patched · Fixed in: 6.23

Latest updates:

2023-10-18: Google TAG: government-backed actors exploiting the WinRAR bug (source)
2023-08-24: CISA adds CVE-2023-38831 to the KEV catalog
2023-08-23: Group-IB: zero-day exploited since April 2023 against traders (source)

CVEs: CVE-2023-38831