Is CVE-2019-25677 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25677 being exploited in the wild.

How severe is CVE-2019-25677?

Medium severity, with a CVSS score of 6.2, published 5 April 2026.

Which products and versions are affected?

RARLAB WinRAR 5.61 (32-bit) and earlier.

Is there a fix for CVE-2019-25677?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25677 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2019-25677?

Check whether you run RARLAB WinRAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25677: RARLAB WinRAR denial of service via malformed language file

CVE-2019-25677 · Severity: medium · CVSS 6.2 · Published 2026-04-05

WinRAR, a widely used file compression and archiving utility, is vulnerable to a flaw that allows a local user to crash the application. By placing a specially crafted language file in the program's installation folder, an attacker can cause the software to stop responding or shut down unexpectedly when performing standard archive tests. This results in a denial of service for the affected user but does not typically lead to data theft or unauthorized system access.

Technologies: RARLAB WinRAR. Vendors: RARLAB.

Quick answers

Is CVE-2019-25677 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25677 being exploited in the wild.
How severe is CVE-2019-25677?: Medium severity, with a CVSS score of 6.2, published 5 April 2026.
Which products and versions are affected?: RARLAB WinRAR 5.61 (32-bit) and earlier.
Is there a fix for CVE-2019-25677?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25677 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2019-25677?: Check whether you run RARLAB WinRAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in WinRAR 5.61 (32-bit) due to improper handling of language files (.lng). A local attacker with the ability to write to the application's installation directory can place a malformed 'winrar.lng' file to trigger an access violation. The crash occurs at memory address 004F1DB8 when a user opens an archive and clicks the 'Test' button, causing the application to attempt to read invalid data from the corrupted language file. While categorized under CWE-379 (Creation of Temporary File in Directory with Insecure Permissions) by some sources, the primary impact is an application-level crash (Access Violation).

Affected products

RARLAB WinRAR 5.61 (32-bit) and earlier

Timeline

2019-02-20: disclosed: Initial discovery and exploit published on Exploit-DB
2026-04-05: advisory: NVD/VulnCheck advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.