WinRAR CVE-2026-14191

Exploitation requires the victim to possess an attacker-supplied RAR5 recovery-volume set of two or more .rev files (the OOB write is triggered by the second and subsequent .rev files, whose RecNum is validated only against their own TotalCount) AND to actively perform a recovery/test/repair operation on it - specifically running 'unrar t' (or another test/recover command) on the .rev set, invoking WinRAR's 'Repair archive' function, or triggering auto-recovery by extracting a volume set that has a missing .rar part. Limiting factors: it is not remotely or automatically exploitable (CVSS UI:R and AV:L), a single .rev file is insufficient, and the target must be a WinRAR/RAR/UnRAR/unrar.dll build older than 7.23; no attacker authentication or elevated privileges are needed (PR:N), and the code runs with the victim user's privileges.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) accurately captures the shape: exploitation is local and requires user interaction (the victim must actively invoke a recovery/test/repair on the malicious .rev set), but needs no attacker privileges and yields high confidentiality, integrity, and availability impact via heap corruption. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input - treat the absence as missing data, not as low risk. The strongest risk signal is contextual rather than statistical: this is the RAR5-path sibling of CVE-2023-40477, which was added to CISA KEV and weaponized, so the attack surface and exploitability pattern are well understood and a working exploit for this variant is plausible even though none is confirmed. The UI:R requirement is a genuine limiter - this is not wormable or remotely automatable - placing it in the 'deliberate targeting / social-engineering' tier rather than mass-exploitation, but the ubiquity of WinRAR and the routine use of repair/recovery features make it a real patch priority.

An attacker emails or hosts a multi-volume archive together with a crafted set of two or more .rev recovery files, or ships a volume set with a deliberately missing .rar part to trigger auto-recovery. When the victim attempts to repair or recover the archive (e.g. 'unrar t x.part1.rev' or WinRAR 'Repair archive'), the parser writes the attacker-controlled RevCRC value far past the RecItems buffer, corrupting adjacent heap objects and potentially achieving code execution in the user's context. No public exploit is identified at time of analysis, though the closely related CVE-2023-40477 was exploited in the wild.