PT-2025-32352 · Rarlab+1 · Winrar

Anton Cherepanov

+2

·

Published

2025-07-30

·

Updated

2026-02-28

·

CVE-2025-8088

CVSS v3.1
8.8
VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WinRAR versions prior to 7.13
Description WinRAR contains a path traversal vulnerability that allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability has been actively exploited in the wild by multiple threat actors, including Russia-linked groups (RomCom, Paper Werewolf, Gamaredon, APT44, Turla) and China-linked groups (Amaranth-Dragon, APT41). The exploitation involves embedding malicious payloads within Alternate Data Streams (ADS) of RAR archives, which, when opened, can write files to sensitive system locations like the Startup folder, leading to persistent malware execution. The vulnerability is identified as CVE-2025-8088 and was patched in WinRAR version 7.13. The exploitation has been observed in phishing campaigns targeting various sectors, including government, military, finance, and technology.
Recommendations Update WinRAR to version 7.13 or later immediately.

Fix

RCE

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2025-09597
CVE-2025-8088

Affected Products

Winrar