CVE-2026-14191, heap overflow in the RAR5 recovery volume parsing, 7.8. crafted archive, user opens it, memory corruption, you already know how this goes.

honestly the bug isn't what gets me. it's that in 2026 winrar still ships with no automatic update. every time one of these drops the fix is out same day and then basically nobody installs it, because the app has never once in its life told a user to update. so the vulnerable install base barely moves and the phishing crews absolutely know that. this is the whole reason old winrar CVEs stay useful for years.

i pushed the new build through our deployment tool this morning to everything i can actually see. the machines i can't are the problem, the byod stuff and the two contractors who "use their own laptop." at this point i just treat winrar like any other unmanaged-update app, inventory it and force it, because expecting people to manually update a tool that never prompts them is how you end up named in the writeup.

i've been trying to move us to 7-zip for years and i lose on "but we need it for the .rar exports from that one vendor" every single time. so here we are again.

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.

Attackers are abusing Alternate Data Streams (ADS) to perform path traversal during archive extraction. By appending colon symbol (:) in file names, they sneak hidden objects into system folders without showing anything in the WinRAR UI.

This vulnerability is dangerous for organizations as the malicious files remain invisible in WinRAR’s interface and many security tools. Employees believe the archive is safe, while persistence is silently installed and activated on reboot.

In one observed case inside ANYRUN Sandbox: Genotyping\Results\B57\Positive.pdf:.\\..\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Display Settings.lnk Places a .lnk in Startup that executes %LOCALAPPDATA%\\ApbxHelper.exe after reboot. Result: remote code execution and long-term persistence.

See full analysis of this CVE: https://app.any.run/tasks/34dcc9a8-4608-4bb3-8939-2dfe9adf5501

Next steps for orgs:

Patch WinRAR → 7.13 Detonate suspect archives in ANYRUN → reveal hidden NTFS ADS files + export IOCs Use TI Lookup to track campaigns and enrich IOCs with live attack data from 15k orgs

Query 1 – Startup file creation via WinRAR Query 2 – All CVE-2025-8088 samples

IOCs: SHA256: a99903938bf242ea6465865117561ba950bd12a82f41b8eeae108f4f3d74b5d1 Genotyping\Results\B57\Positive.pdf

a25d011e2d8e9288de74d78aba4c9412a0ad8b321253ef1122451d2a3d176efa Display Settings.lnk

8082956ace8b016ae8ce16e4a777fe347c7f80f8a576a6f935f9d636a30204e7 ApbxHelper.exe

Code Signing Certificate: SN: FE9A606686B3A19941B37A0FC2788644 Thumb: 1EE92AC61F78AAB49AECDDB42D678B521A64EA01 Issuer: Simon Gork

A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.

Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.