Actively exploited in the wild
RARLAB WinRAR Code Execution Vulnerability
RARLAB — WinRAR · Listed in the CISA KEV since 2023-08-24. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-38831
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk100th percentile — higher than 100% of all known CVEs
Summary
WinRAR versions before 6.23 allow attackers to execute arbitrary code when a user attempts to open a benign file within a ZIP archive. The issue occurs when the ZIP archive contains a benign file (such as a regular .JPG file) and a folder with the same name, and the contents of the folder (which may include executable content) are processed when trying to access only the benign file.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the organization's security. Attackers may gain full control over the compromised system.
Recommendation
It is recommended to update WinRAR to version 6.23 or newer to mitigate the risk associated with this vulnerability. Additionally, users should exercise caution when opening files from unknown sources.
Original NVD description (English source)
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.