EUVD-2026-40869
GHSA-5hjj-fvq6-8j36
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector and UI:R because the victim must actively run a recovery/repair on the malicious .rev set; no attacker privileges (PR:N), with heap corruption yielding full C/I/A impact.
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.
AnalysisAI
Out-of-bounds heap write in the RAR5 recovery-volume (.rev) parser of WinRAR, RAR, UnRAR, and unrar.dll (versions before 7.23) lets an attacker corrupt heap memory when a victim runs a recovery, test, or repair operation on a crafted multi-file .rev set. Because subsequent .rev files supply a RecNum value validated only against their own TotalCount and never against the actual RecItems allocation, an attacker-controlled 32-bit value can be written far past the buffer, enabling memory corruption and potential code execution. There is no public exploit identified at time of analysis, but this is the RAR5-path sibling of the previously exploited CVE-2023-40477, and CWE-787 flaws in WinRAR have historically led to reliable RCE.
Technical ContextAI
The flaw lives in RecVolumes5::ReadHeader in recvol5.cpp, which handles RAR5-format recovery volumes (.rev files) used to reconstruct damaged or missing parts of a multi-volume archive. The RecItems vector is sized once, when the first .rev in a set is parsed, but each later .rev header carries its own RecNum index that is bounds-checked only against that file's TotalCount field rather than against the true length of RecItems. This classic missing-cross-object-validation error (CWE-787, out-of-bounds write) allows RecItems[RecNum] to be indexed up to 65534 * sizeof(RecVolItem) bytes beyond the allocation, writing the header's attacker-supplied RevCRC field into adjacent heap objects. CPE data confirms all RARLAB distributions are in scope - rarlab:winrar, rarlab:rar (the CLI RAR), rarlab:unrar, and the embeddable rarlab:unrar.dll - meaning any third-party application bundling unrar.dll for archive handling inherits the vulnerability.
RemediationAI
Vendor-released patch: WinRAR / RAR / UnRAR 7.23, which fixes the RAR5 recovery-volume path (the RAR3 path was fixed earlier in 6.23 for CVE-2023-40477); upgrade all instances from https://www.rarlab.com/download.htm and rebuild or update any application that embeds unrar.dll to the 7.23 library. Because WinRAR does not auto-update, manual redeployment across endpoints is required. If patching cannot be completed immediately, the concrete compensating control is to avoid running recovery, test, or repair operations on untrusted .rev files - do not use 'unrar t' on attacker-supplied .rev sets, disable or decline WinRAR's 'Repair archive' on untrusted archives, and be aware that auto-recovery can trigger automatically when extracting a volume set with a missing .rar part, so treat incomplete/damaged multi-volume archives from untrusted sources as hostile. The trade-off is loss of legitimate recovery functionality for damaged archives until the update is applied.
WinRAR before 5.61 contains a path traversal vulnerability in the ACE archive format handler (UNACEV2.dll) that allows e
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
WinRAR for Windows contains a path traversal vulnerability allowing crafted archives to execute arbitrary code, discover
WinRAR contains a directory traversal vulnerability (CVE-2025-6218, CVSS 7.8) enabling remote code execution when users
RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a differen
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial o
WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a
The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse f
Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points t
RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exp
Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today