Unrar

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.

Published: 2026-07-01T02:41:39.316Z
Updated: 2026-07-09T04:47:54.319Z

UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.

Published: 2023-08-07T00:00:00.000Z
Updated: 2024-10-17T13:57:07.973Z

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Published: 2022-05-09T00:00:00.000Z
Updated: 2026-08-04T03:55:36.847Z

UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.

Published: 2021-07-01T02:54:03.000Z
Updated: 2024-08-05T12:26:39.592Z

libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.

Published: 2017-08-18T14:00:00.000Z
Updated: 2024-08-05T18:51:07.386Z