WinRAR 7.23 Patches Critical Heap Overflow Vulnerability (CVE-2026-14191) WinRAR has released version 7.23, addressing a critical heap overflow vulnerability (CVE-2026-14191) in its RAR5 recovery volume processing code. The flaw, discovered by security researcher Arjun Basnet of Securin Labs, could allow attackers to trigger out-of-bounds writes on the heap by crafting malicious RAR5 recovery volume (.rev) files. Exploitation may lead to application crashes or, under specific conditions, arbitrary code execution. The vulnerability affects WinRAR, command-line RAR, and UnRAR components, though the UnRAR.dll library used in third-party integrations is not directly impacted, as it lacks recovery volume processing. Attackers would need to trick users or automated systems into processing a malicious .rev file alongside a target archive, a tactic relevant in environments where RAR tools are embedded in email servers, backup systems, or file-processing pipelines. In addition to the heap overflow fix, WinRAR 7.23 strengthens symbolic link handling during extraction to prevent path-traversal attacks, even without the `-ola` option enabled. The update also includes security patches for the bundled 7z extraction library (7zxa.dll v26.02), addressing upstream vulnerabilities in 7-Zip archive processing. Given the historical exploitation of WinRAR flaws in financially motivated attacks, organizations are advised to update to version 7.23 or later, particularly on systems handling untrusted archives. Systems embedding RAR or UnRAR in server-side workflows should verify updated binaries and monitor for suspicious recovery volumes.

A critical zero-day vulnerability (CVE-2025-8088) in WinRAR’s Windows version (pre-7.13) enabled path traversal attacks, allowing threat actors to deploy malware via malicious RAR archives. Exploited by RomCom (Storm-0978) and Paper Werewolf (GOFFEE), the flaw facilitated phishing campaigns targeting financial, manufacturing, defense, and logistics sectors in Europe, Canada, and Russia. Attackers disguised malicious archives as job resumes or official communications, deploying backdoors (SnipBot, RustyClaw, Mythic) for persistence and data exfiltration. The exploit leveraged alternate data streams (ADS) to hide payloads in Windows Startup folders, achieving remote code execution upon user login. While no mass exploitation was reported by August 2025, the vulnerability’s public disclosure (CVSS 8.8) and dark web sale ($80,000) heightened risks of copycat attacks. Organizations faced potential data breaches, system compromises, and operational disruptions, though no confirmed large-scale data leaks or ransomware incidents were tied to this flaw. Patching (WinRAR 7.13) mitigated the risk, but delayed updates left users exposed to targeted cyber espionage and financial theft.

A recently fixed WinRAR vulnerability (CVE-2025-8088) was exploited as a zero-day in phishing attacks to install the RomCom malware. The flaw, a directory traversal vulnerability, allowed attackers to extract files into arbitrary paths, leading to remote code execution when users logged in. The RomCom group, linked to ransomware and data-theft extortion, used this vulnerability to deliver backdoors and steal credentials. The attack targeted users through phishing emails with malicious RAR files, exploiting the lack of auto-update in WinRAR. Users were advised to manually update to WinRAR 7.13 to mitigate the risk.

RARLAB, the developer of WinRAR, recently patched a critical vulnerability, CVE-2025-31334, that could bypass Windows' Mark of the Web security feature. The flaw, present in versions before 7.11, allowed attackers to execute malicious code without triggering security warnings, potentially giving them control over affected systems. Although creating symbolic links requires admin privileges, posing a hurdle to widespread exploitation, the risk remains for systems with compromised administrators or relaxed permissions. No active exploits have been reported, but similar vulnerabilities have led to malware attacks. The incident underscores the importance of vigilant software updating and highlights the ongoing security challenges for widely-used applications like WinRAR.