PT-2025-32352 · Rarlab +1 · Winrar

Anton Cherepanov

+2

·

Published

2025-07-30

·

Updated

2025-10-22

·

CVE-2025-8088

CVSS v3.1
8.8
VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WinRAR versions prior to 7.13
Description A path traversal vulnerability exists in the Windows version of WinRAR, allowing attackers to execute arbitrary code by crafting malicious archive files. This vulnerability has been actively exploited in the wild by threat actors, including the RomCom and Paper Werewolf groups. Exploitation involves crafting RAR archives that, when extracted, place malicious payloads into system startup folders, leading to automatic execution of malicious code upon system login. The vulnerability allows attackers to bypass security measures and install backdoors for full system access. The vulnerability was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
Recommendations Update WinRAR to version 7.13 or later. As WinRAR does not have an auto-update feature, a manual update is required.

Fix

RCE

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2025-09597
CVE-2025-8088

Affected Products

Winrar