{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T03:01:01.167Z",
  "tag": {
    "id": "winrar",
    "label": "WinRAR",
    "isStack": false,
    "url": "https://pwn.watch/t/winrar",
    "feed": "https://pwn.watch/t/winrar/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "winrar-zero-day-cve-2023-38831",
      "title": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831",
      "json": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "RARLAB WinRAR",
      "tags": [
        "winrar",
        "rarlab",
        "windows",
        "zero-day",
        "rce",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-38831"
      ],
      "affectedVersions": [
        "Before 6.23 (NVD)"
      ],
      "fixedVersions": [
        "6.23"
      ],
      "startedAt": "2023-08-02",
      "closedAt": "2023-10-18",
      "updatedAt": "2023-10-18",
      "summary": "WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-18",
      "title": "Google TAG: government-backed actors exploiting the WinRAR bug",
      "body": null,
      "sourceUrl": "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    },
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-24",
      "title": "CISA adds CVE-2023-38831 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    },
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-23",
      "title": "Group-IB: zero-day exploited since April 2023 against traders",
      "body": null,
      "sourceUrl": "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    },
    {
      "incident": "winrar-zero-day-cve-2023-38831",
      "incidentTitle": "WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-02",
      "title": "WinRAR 6.23 released with the fix",
      "body": null,
      "sourceUrl": "https://www.rarlab.com/rarnew.htm",
      "url": "https://pwn.watch/i/winrar-zero-day-cve-2023-38831"
    }
  ]
}