High severity · published Aug 23, 2023
CVE-2023-38831
RARLAB WinRAR Code Execution Vulnerability
RansomwareIn wildKEV
7.8
CVSS
99.8%
EPSS
Yes
On KEV
Description
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.8% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 24, 2023
Federal remediation dueSep 14, 2023
Ransomware campaign useKnown
Affected products
Which versions
WI
Winrar · Rarlab
before 6.23 · source: NVD, CISA, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38831
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38831
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
www.group-ib.com
https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
www.bleepingcomputer.com
https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/
news.ycombinator.com
https://news.ycombinator.com/item?id=37236100
packetstormsecurity.com
http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html
blog.google
https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
More from Winrar
8.8
CVE-2025-8088
Path traversal vulnerability in WinRAR
7.8
CVE-2025-6218
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
7.8
CVE-2018-20250
WinRAR Absolute Path Traversal Vulnerability
7.8
CVE-2026-14191
WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader
7.8
CVE-2023-40477
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability