Pierluigi Paganini August 18, 2023

A flaw impacting the file archiver utility for Windows WinRAR can allow the execution of commands on a computer by opening an archive.

WinRAR is a popular file compression and archival utility for Windows operating systems. The utility is affected by a now-fixed high-severity vulnerability, tracked as CVE-2023-40477 (CVSS score 7.8), that can allow remote execution of arbitrary code on a computer by opening a crafted RAR archive.

The vulnerability exists within the processing of recovery volumes and is caused by the lack of proper validation of user-supplied data.

The vulnerability was reported to RARLAB on June 8th, 2023, by researcher “goodbyeselene” of the Zero Day Initiative.

“This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” reads the ZDI’s advisory. “The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.”

WinRAR addressed the flaw with the release of version 6.23.

WINRAR users are recommended to update their installs before threat actors starts weaponizing the flaw in attacks in the wild.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, RAR)