CVE-2019-25677
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. The crash occurs when opening an archive and pressing the test button.
Risk Assessment
The organization is at risk of a local DoS attack that could prevent users from using WinRAR, potentially disrupting work.
Recommendation
Update WinRAR to version 5.70 or later, which contains the fix.
Original NVD description (English source)
WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.