CVE-2023-38831
RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.htmlExploitThird Party Advisory
- blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/ExploitThird Party Advisory
- news.ycombinator.com/item?id=37236100Issue Tracking
- bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/ExploitPress/Media Coverage
- group-ib.com/blog/cve-2023-38831-winrar-zero-day/ExploitPress/Media Coverage
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831US Government Resource
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1140 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 99.8% · top 1% of all CVEs
- Weakness
- CWE-345
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 4.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.