WinRAR Zero-Day Under Active Exploitation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36884 | Race Condition RCE in Microsoft Windows Search CVE-2023-36884 is a race condition (TOCTOU) vulnerability in Microsoft Windows Search that permits remote code execution, rated 7.5 (high) on CVSS 3.1. It is triggered over the network with user interaction — for example, when a user opens or interacts with a specially crafted document that causes the vulnerable search code path to race, allowing arbitrary code execution in the context of the current user. An attacker gains code execution on the victim's Windows system, which the RomCom threat actor chained with Firefox flaws to deploy backdoors against political targets, and CISA notes known ransomware use. Virtually every supported Windows client and server release at the time is affected, spanning Windows 10 1507 through 22H2, Windows 11 21H2/22H2, and Windows Server 2008 through 2022. The flaw was actively exploited as a zero-day before being fixed in the July 2023 Patch Tuesday; it was added to the CISA KEV catalog on 2023-07-17 and carries a 98.9% EPSS score (100th percentile). Do: Apply the July 2023 Patch Tuesday Windows security updates to all Windows 10, Windows 11, and Windows Server systems, prioritizing high-value and frequently attacked endpoints since the bug was exploited as a zero-day by RomCom and carries a KEV deadline (US civilian agencies were directed to remediate by August 1, 2023). Because exploitation requires user interaction, caution users against opening untrusted documents, and verify patch status via your patch management or vulnerability scanner against the KEV requirement. If patching is not possible, follow vendor mitigations per CISA's required action or discontinue use. | 7.5 | 99% | KEV ransomware |
| mass≈1 billion+ Windows devices (Windows 10/11 installed base) plus the enterprise Windows Server estate | |
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) | |
| CVE-2025-55188 | 7-Zip before 25.01 does not always properly handle symbolic links during extraction. 7-Zip before 25.01 does not always properly handle symbolic links during extraction. NVD description · AI analysis pending | 3.6 | <1% | PoC ×3 |
| — | |
| CVE-2025-6218 | Directory Traversal RCE in RARLAB WinRAR RARLAB WinRAR contains a directory traversal flaw (CWE-22) in its handling of file paths within archive files, allowing a crafted archive path to traverse to unintended directories during extraction. Exploitation requires user interaction: the target must open a malicious file (e.g., a booby-trapped archive) or visit a malicious page. A successful attacker executes arbitrary code in the context of the current user, yielding full high-impact code execution on the endpoint (CVSS 3.0: 7.8, local attack vector with required user interaction). Any installation running an affected version of RARLAB WinRAR is exposed; the specific affected version range is not stated in the source data, so defenders should confirm against RARLAB's advisory. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-12-09, Google warned of active exploitation, public reporting ties the campaign to APT-C-08 and at least one other actor group, and EPSS stands at 90.5%. Do: Update WinRAR to the latest vendor release that addresses CVE-2025-6218 per RARLAB's advisory (the fixed version number is not provided in the source data), and treat this as urgent given the KEV listing and 90.5% EPSS. Warn users not to open archives from untrusted or unexpected sources, and inspect email-borne .rar/.zip attachments. Hunt for unusual child processes or file writes outside expected directories following archive extraction, and note U.S. federal civilian agencies must apply mitigations under BOD 22-01. | 7.8 | 91% | KEV PoC ×2 |
| masshundreds of millions of users/installations worldwide | |
| CVE-2025-8088 | WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution A path traversal flaw (CWE-35) in the Windows version of WinRAR allows attackers to achieve arbitrary code execution by delivering a specially crafted archive file that writes outside the expected location when it is opened or processed. Because the CVSS 4.0 vector indicates a local attack requiring user interaction, victims are typically infected by extracting or previewing a malicious archive received via phishing, a malicious download, or another delivery channel. A successful attacker gains the privileges of the user running WinRAR, providing an initial foothold that has been used for both espionage and ransomware operations. Anyone running the Windows version of WinRAR — one of the most widely deployed Windows desktop utilities — is affected, and CPE data additionally lists dtSearch as an affected vendor. Exploitation is confirmed in the wild by nation-state actors (e.g., the China-linked Amaranth-Dragon group per related reporting) and criminal actors including ransomware operators; the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-12 and carries a near-maximal 94.6% EPSS score. Do: Update WinRAR to the latest patched release from RARLAB on all Windows endpoints, prioritizing remediation per CISA KEV and BOD 22-01 requirements, and verify that dtSearch deployments bundling the affected component are also updated. Because exploitation requires a user to open or extract a crafted archive, warn users to treat unexpected archive files delivered by email or download with suspicion. Given confirmed ransomware use, hunt across user workstations — not just exposed servers — for suspicious archive-based infections and confirm the patched WinRAR version is installed. | 8.4 | 95% | KEV ransomware |
| masshundreds of millions of Windows users/devices (est.; RARLAB has historically claimed user counts in the hundreds of millions) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | bi.zone | code execution on the next system login." The attacks, per BI.ZONE, targeted Russian organizations in July 2025 via phishing e |
Full article1,124 words · extracted from thehackernews.com · click to collapse
The maintainers of the WinRAR file archiving utility have released an update to address an actively exploited zero-day vulnerability.
Tracked as CVE-2025-8088 (CVSS score: 8.8), the issue has been described as a case of path traversal affecting the Windows version of the tool that could be exploited to obtain arbitrary code execution by crafting malicious archive files.
"When extracting a file, previous versions of WinRAR, Windows versions of RAR, UnRAR, portable UnRAR source code and UnRAR.dll can be tricked into using a path, defined in a specially crafted archive, instead of a specified path," WinRAR said in an advisory.
Anton Cherepanov, Peter Kosinar, and Peter Strycek from ESET have been credited for discovering and reporting the security defect, which has been addressed in WinRAR version 7.13 released on July 30, 2025.
The development is the second time a WinRAR security vulnerability has been weaponized in the wild in as many years. In 2023, another vulnerability affecting WinRAR (CVE-2023-38831, CVSS score: 7.8) came under heavy exploitation, including as a zero-day, by multiple threat actors from China and Russia.
Russian cybersecurity vendor BI.ZONE, in a report published last week, said there are indications that the hacking group tracked as Paper Werewolf (aka GOFFEE) may have leveraged CVE-2025-8088 alongside CVE-2025-6218, a directory traversal bug in the Windows version of WinRAR that was patched in June 2025.
It's important to note that prior to these attacks, a threat actor identified as "zeroplayer" was spotted advertising on July 7, 2025, an alleged WinRAR zero-day exploit on the Russian-language dark web forum Exploit.in for a price tag of $80,000. It's suspected that the Paper Werewolf actors may have acquired it and used it for their attacks.
"In previous versions of WinRAR, as well as RAR, UnRAR, UnRAR.dll, and the portable UnRAR source code for Windows, a specially crafted archive containing arbitrary code could be used to manipulate file paths during extraction," WinRAR said in an alert for CVE-2025-6218 at the time.
"User interaction is required to exploit this vulnerability, which could cause files to be written outside the intended directory. This flaw could be exploited to place files in sensitive locations – such as the Windows Startup folder – potentially leading to unintended code execution on the next system login."
The attacks, per BI.ZONE, targeted Russian organizations in July 2025 via phishing emails bearing booby-trapped archives that, when launched, triggered CVE-2025-6218 and likely CVE-2025-8088 to write files outside the target directory and achieve code execution, while a decoy document is presented to the victim as a distraction.
"The vulnerability is related to the fact that when creating a RAR archive, you can include a file with alternative data streams, the names of which contain relative paths," BI.ZONE said. "These streams can contain arbitrary payload. When unpacking such an archive or opening an attached file directly from the archive, data from the alternative streams is written to arbitrary directories on the disk, which is a directory traversal attack."
"The vulnerability affects WinRAR versions up to and including 7.12. Starting with version 7.13, this vulnerability is no longer reproduced."
One of the malicious payloads in question is a .NET loader that's designed to send system information to an external server and receive additional malware, including an encrypted .NET assembly.
"Paper Werewolf uses the C# loader to get the victim's computer name and send it in the generated link to the server to get the payload," the company added. "Paper Werewolf uses sockets in the reverse shell to communicate with the control server."
WinRAR Flaw Also Exploited by RomCom
Slovakian cybersecurity company ESET said it first observed the Russia-aligned group RomCom exploiting CVE-2025-8088 as a zero-day on July 18, 2025, marking the third time the hacking crew has employed zero-days in its attacks after CVE-2023-36884 (June 2023), CVE‑2024‑9680 and CVE‑2024‑49039 (October 2024).
"Successful exploitation attempts delivered various backdoors used by the RomCom group, specifically a SnipBot variant, RustyClaw, and Mythic agent," researchers Cherepanov, Strycek, and Damien Schaeffer said. "This campaign targeted financial, manufacturing, defense, and logistics companies in Europe and Canada."
The attacks leverage malicious archives that contain one benign but several alternate data streams (ADSes) that are leveraged for path traversal. The messages make use of resume-themed lures to trick recipients into opening the attachments.
Opening the archive triggers the execution of a malicious DLL, while a Windows shortcut (LNK) file is set up in the Windows startup directory to achieve persistence every time a user logs in to the system. This DLL is responsible for decrypting embedded shellcode, which then paves the way for the Mythic agent, a SnipBot (aka SingleCamper) variant, and RustyClaw.
RustyClaw fetches and executes another payload, another downloader called MeltingClaw (aka DAMASCENED PEACOCK), which has been used to drop backdoors such as ShadyHammock or DustyHammock in the past.
The company said none of the targets were compromised, citing telemetry data, but the development demonstrates the continued maturation of RomCom to a sophisticated threat actor capable of adopting zero-days into its arsenal for targeted attacks.
"By exploiting a previously unknown zero-day vulnerability in WinRAR, the RomCom group has shown that it is willing to invest serious effort and resources into its cyber operations," ESET said. "The discovered campaign targeted sectors that align with the typical interests of Russian-aligned APT groups, suggesting a geopolitical motivation behind the operation."
7-Zip Plugs Arbitrary File Write Bug
The disclosure comes as 7-Zip shipped patches for a security flaw (CVE-2025-55188, CVSS score: 2.7) that could be abused for arbitrary file write due to the manner the tool handles symbolic links during extraction, which may result in code execution. The issue has been addressed in version 25.01.
In a possible attack scenario, a threat actor could leverage the flaw to achieve unauthorized access or code execution by tampering with sensitive files, such as by overwriting a user's SSH keys or .bashrc file.
The attack mainly targets Unix systems, but can also be adapted for Windows with additional prerequisites. "On Windows, the 7-Zip extraction process must have the capability to create symbolic links (e.g., extract with Administrator privileges, Windows is in Developer Mode, etc.)," security researcher "lunbun" said.
Update
ESET researcher Cherepanov confirmed to The Hacker News that the WinRAR exploit used by Paper Werewolf is "definitely" the same, but said they "currently have no visibility into any attacks targeting Russia."
The researcher also noted that "while we don't have hard evidence that RomCom or Paper Werewolf obtained the WinRAR zero-day from a cybercriminals' forum, it is highly likely that this was the case."
(The story was updated after publication to include a response from ESET.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/08/winrar-zero-day-under-active.html