CVE-2004-1254
HighSummary
Vulnerability in WinRAR 3.40 and earlier versions allows remote attackers to execute arbitrary code via a crafted ZIP file containing a file with a long filename. The issue stems from an integer overflow leading to a buffer overflow.
Risk Assessment
The risk for the organization is the possibility of remote code execution by an attacker after opening a malicious ZIP file, which could lead to system compromise, data theft, or further attack propagation.
Recommendation
It is recommended to immediately update WinRAR to the latest available version that fixes this vulnerability. Also consider implementing security policies to restrict opening ZIP files from untrusted sources.
Related vulnerabilities
- CVE-2026-79876Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79875Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79874Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79873Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79872Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79871Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79870Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79869Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79868Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79867Critical
No vulnerability description is available in the NVD. The nature and scope of the issue cannot be determined from the provided data.
Original NVD description (English source)
WinRAR 3.40, and possibly earlier versions, allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, possibly causing an integer overflow that leads to a buffer overflow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS