PT-2025-32352 · Rarlab+1 · Winrar

Anton Cherepanov

+2

·

Published

2025-07-30

·

Updated

2026-03-19

·

CVE-2025-8088

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WinRAR versions prior to 7.13
Description WinRAR contains a path traversal vulnerability that allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability, tracked as CVE-2025-8088, has been actively exploited in the wild by multiple threat actors, including Russia-linked groups (RomCom, Paper Werewolf, Gamaredon), China-linked groups (Amaranth-Dragon), and financially motivated cybercriminals. Attackers exploit this flaw by embedding malicious payloads within Alternate Data Streams (ADS) of RAR archives. When a user opens a crafted archive, the malware is written to sensitive system locations, such as the Startup folder, leading to automatic execution upon system login. The vulnerability allows attackers to bypass security measures and install backdoors, steal data, and deploy ransomware. The vulnerability was patched in WinRAR version 7.13, but due to the lack of an auto-update feature, many systems remain vulnerable.
Recommendations Update WinRAR to version 7.13 or later immediately.

Fix

RCE

Weakness Enumeration

CWE-35

Related Identifiers

BDU:2025-09597
CVE-2025-8088

Affected Products

Winrar