CVE-2026-14191, heap overflow in the RAR5 recovery volume parsing, 7.8. crafted archive, user opens it, memory corruption, you already know how this goes.

honestly the bug isn't what gets me. it's that in 2026 winrar still ships with no automatic update. every time one of these drops the fix is out same day and then basically nobody installs it, because the app has never once in its life told a user to update. so the vulnerable install base barely moves and the phishing crews absolutely know that. this is the whole reason old winrar CVEs stay useful for years.

i pushed the new build through our deployment tool this morning to everything i can actually see. the machines i can't are the problem, the byod stuff and the two contractors who "use their own laptop." at this point i just treat winrar like any other unmanaged-update app, inventory it and force it, because expecting people to manually update a tool that never prompts them is how you end up named in the writeup.

i've been trying to move us to 7-zip for years and i lose on "but we need it for the .rar exports from that one vendor" every single time. so here we are again.

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.

A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.