PT-2025-3122 · Unknown · Rar Extractor - Unarchiver

Zaid Hamad · Published 2025-01-21 · Updated 2025-01-21 · CVE-2024-55504

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RAR Extractor - Unarchiver Free and Pro version 6.4.0

Description The issue allows local attackers to inject arbitrary code, potentially leading to remote control and unauthorized access to sensitive user data via the exploit combined.dylib component on MacOS.

Recommendations For RAR Extractor - Unarchiver Free and Pro version 6.4.0, consider disabling the exploit combined.dylib component as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-55504

Affected Products

Rar Extractor - Unarchiver

References · 6

• 🔥 https://github.com/SyFi/CVE-2024-55504 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55504 · Security Note
• https://twitter.com/CVEnew/status/1881806581140246597 · Twitter Post
• https://github.com/Audit00r/RAR-Extractor-Unarchiver-Pro-Dylib-injection · Note
• https://t.me/cvedetector/16005 · Telegram Post
• https://apps.apple.com/us/app/rar-extractor-unarchiver-pro/id647505820?mt=12 · Note