WinRAR flaw could allow attackers to take control of your computer

1. Executive summary

Rarlab has patched a remote code execution vulnerability (CVE-2026-14191) in WinRAR and UnRAR affecting RAR5 recovery-volume (.rev) file handling. The flaw is a heap buffer overflow variant of CVE-2023-40477 and is fixed in WinRAR 7.23, but WinRAR lacks automatic update functionality, meaning patched versions must be deployed manually. CVSS scoring is not available in the verified reference data and the CVE is not listed in CISA KEV. EMEA financial services with WinRAR/UnRAR deployed on endpoint estates face an RCE risk if users can be social-engineered into opening crafted .rev files.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability mechanism

CVE-2026-14191 is a heap buffer overflow in the RAR5 recovery-volume (.rev) file handling code shared between WinRAR and UnRAR. An attacker crafts a set of two or more malicious .rev files that cause WinRAR/UnRAR to write data past the end of an allocated memory buffer. The resulting heap corruption may be leveraged for arbitrary code execution within the process context of the archive tool.

The vulnerability is described as a variant of CVE-2023-40477, which was also located in the recovery volume handling code, according to the European Vulnerability Database entry EUVD‑2026‑40869. This lineage indicates the recovery-volume parsing path remains a recurring weak point.

Attack chain (confirmed steps)

1. Delivery: Attacker delivers two or more crafted .rev files to the target — likely via email attachment, download link, or shared drive. The .rev files appear as legitimate RAR5 recovery volumes.
2. Execution trigger: Victim opens or processes the .rev files with WinRAR or UnRAR (e.g., by double-clicking, or via a repair/extract operation on an archive that references the recovery volumes).
3. Memory corruption: The crafted .rev files trigger a write past the end of a heap-allocated buffer during recovery-volume parsing.
4. Code execution: The heap corruption is leveraged to redirect execution to attacker-controlled payload, achieving RCE in the context of the WinRAR/UnRAR process.

Scope and affected components

• Products affected: WinRAR and UnRAR (the standalone extraction library).
• Platforms: Windows, macOS, Android, Linux, FreeBSD (all supported WinRAR platforms).
• Architectures: 64-bit, 32-bit, and ARM.
• Fixed version: WinRAR 7.23.
• File type involved: RAR5 recovery-volume (.rev) files.

Attribution caveat

The Malwarebytes source references that a 2025 WinRAR vulnerability was exploited by Russia-aligned groups against Ukrainian organisations long after it had been patched. This is historical context, not attribution for CVE-2026-14191. No named actor is attributed to current exploitation of this CVE. No MITRE ATT&CK profile is available for any actor in the verified reference data. Attribution for any current exploitation campaign is unconfirmed.

Single-source caveat

The EUVD‑2026‑40869 reference and the CVE-2023-40477 lineage claim are sourced solely through the Malwarebytes article. The BSI advisory (WID-SEC-2026-2152) corroborates the existence of the vulnerability and its RCE classification but does not independently confirm the CVE-2023-40477 variant relationship. Treat the variant lineage as single-sourced; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Inventory: Identify all assets running WinRAR or UnRAR across the estate. Query software inventory/asset management systems for winrar.exe, unrar.exe, unrar (Linux/macOS). Record version numbers.
• Containment — block .rev processing: If endpoint DLP or mail gateway supports it, create a rule to quarantine or block .rev file attachments in email and web downloads. This directly targets the attack vector.
• Containment — EDR: Deploy an EDR/application control rule to alert on WinRAR/UnRAR processes (winrar.exe, unrar.exe, unrar) spawning child processes (e.g., cmd.exe, powershell.exe, wscript.exe), which would indicate potential post-expit activity.

P2 — Within 72 hours

• Patch deployment: Download WinRAR 7.23 from the official Rarlab site (https://www.rarlab.com) for each affected platform and architecture in the estate. Deploy via software distribution tooling (e.g., SCCM, Intune, Ansible, Jamf). Ensure the correct architecture (64-bit, 32-bit, or ARM) is selected per asset.
• Remove where unnecessary: Per the Malwarebytes recommendation, treat WinRAR as optional software. If users do not require it for business reasons, remove it via asset management to shrink the attack surface. Prioritise removal on high-risk endpoints (e.g., those receiving external email).
• Update UnRAR separately: UnRAR is distributed independently on some platforms (Linux, macOS, FreeBSD via package managers). Update the unrar package to the latest version available in the relevant repository.

P3 — Within 7 days

• Monitor for updates: Establish a monitoring process for WinRAR/UnRAR updates given the lack of automatic update functionality. Use a third-party update monitoring tool or subscribe to vendor/BSI advisories.
• User awareness: Communicate to users not to open unsolicited archive files or .rev files from unverified sources.
• Verify patch coverage: Re-run asset inventory to confirm all WinRAR/UnRAR installations are at version 7.23 or later. Identify and remediate any stragglers.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

The sources provide usable artefacts for behavioural detection: the .rev file extension as the attack vector, and the WinRAR/UnRAR process names. No distinctive strings, mutex names, or hard-coded values are present. The following Sigma rule targets suspicious child-process execution from WinRAR/UnRAR, which would indicate post-expit activity following exploitation.

title: WinRAR/UnRAR Suspicious Child Process Execution
id: 6d8a3f12-9e47-4b2a-b1c5-d0e1f2a3b4c5
status: experimental
description: >
  Detects WinRAR or UnRAR spawning suspicious child processes, which may indicate
  exploitation of CVE-2026-14191 (RAR5 recovery-volume heap overflow RCE).
  Attackers can craft .rev files that trigger heap corruption and arbitrary code
  execution within the WinRAR/UnRAR process context.
references:

  - https://www.malwarebytes.com/blog/news/2026/07/winrar-flaw-could-allow-attackers-to-take-control-of-your-computer
  - https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2152
author: Adverse Trace
date: 2026/07/02
logsource:
    product: windows
detection:
    selection_process:
        ParentImage|endswith:

            - '\winrar.exe'
            - '\unrar.exe'
    selection_child:
        Image|endswith:

            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    condition: selection_process and selection_child
falsepositives:

    - Legitimate use of WinRAR's "open archive after extraction" feature launching a non-malicious executable (rare for the listed child processes)
level: high
tags:

    - attack.execution
    - attack.t1203
    - attack.t1059

CVE assessment

1 referenced CVE

Could not resolve: CVE-2023-40477.

7. Sources

• Malwarebytes — "WinRAR flaw could allow attackers to take control of your computer" — https://www.malwarebytes.com/blog/news/2026/07/winrar-flaw-could-allow-attackers-to-take-control-of-your-computer — 2026-07-02
• BSI Germany (CERT-Bund) — "WID-SEC-2026-2152: win.rar WinRAR: Schwachheit ermöglicht Codeausführung" — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2152 — accessed 2026-07-02

8. Adverse Trace position

CVE-2026-14191 presents a credible RCE risk to EMEA financial services with WinRAR/UnRAR in their endpoint estates. The CVSS score is unavailable in verified reference data and the CVE is not in CISA KEV, so we do not assign a severity rating beyond the RCE classification corroborated by both Malwarebytes and BSI. The lack of automatic updates in WinRAR is the primary operational risk: patched versions will not propagate without active management. We assess the immediate exploitation likelihood as moderate — the attack requires user interaction (opening crafted .rev files) but the delivery vector (email/shared drive) is trivial. The historical precedent of a patched 2025 WinRAR vulnerability being exploited by Russia-aligned groups against Ukrainian targets long after remediation was available elevates the concern for laggard patching. Adverse Trace will monitor for CISA KEV addition, CVSS scoring, and any confirmed exploitation reporting. Clients should treat this as a priority patching task and consider removing WinRAR from endpoints where it is not business-critical.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.