WI
Product
WinRAR
On CISA KEVExploited in the wildRansomware-linked
29
CVEs
4
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 12Medium 5Low 0
Watch
Add WinRAR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-8088 RansomwareIn wildKEV | 8.8 | Aug 8 | Path traversal vulnerability in WinRAR Affected: before 7.13 |
| CVE-2025-6218 In wildKEV | 7.8 | Jun 21 | RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability Affected: 7.11 (64-bit) |
| CVE-2023-38831 RansomwareIn wildKEV | 7.8 | Aug 23 | RARLAB WinRAR Code Execution Vulnerability Affected: before 6.23 |
| CVE-2018-20250 RansomwareIn wildKEV | 7.8 | Feb 5 | WinRAR Absolute Path Traversal Vulnerability Affected: through 5.61 |
| CVE-2026-14191 | 7.8 | Jul 1 | WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader Affected: before 7.23 |
| CVE-2023-40477 | 7.8 | May 3 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability Affected: before 6.23 |
| CVE-2018-20253 | 7.8 | Feb 13 | In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats Affected: through 5.60 |
| CVE-2018-20252 | 7.8 | Feb 5 | In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats Affected: through 5.60 |
| CVE-2024-36052 | 7.5 | May 21 | RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899 Affected: before 7.00 |
| CVE-2015-5663 | 7.4 | Dec 30 | The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extensionless filename that… Affected: through 5.30; through 5.30 |
| CVE-2024-33899 | 7.1 | Apr 29 | RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences Affected: before 7.00 |
| CVE-2022-43650 | 7.1 | Mar 29 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0 Affected: 6.11 |
Showing 12