CVE-2023-38831

HIGH CISA KEV EPSS 99.9%
Published Aug 23, 20232y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Aug 23, 2023 2y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Aug 24, 2023 2y ago
KEV Due Sep 14, 2023 1021d overdue

Description

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 1021d
Added
Aug 24, 2023
Due
Sep 14, 2023

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
99.9% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available

Weaknesses 2

CWE-345
CWE-351

Affected Products 1

VendorProductVersionRange
rarlabwinrar* <6.23

References 6

  • packetstormsecurity.com http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html
    ExploitThird Party AdvisoryVDB Entry
  • blog.google https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
    ExploitThird Party Advisory
  • news.ycombinator.com https://news.ycombinator.com/item?id=37236100
    Issue Tracking
  • bleepingcomputer.com https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/
    ExploitPress/Media CoverageThird Party Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831
    US Government Resource
  • group-ib.com https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
    ExploitPress/Media CoverageThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.