Executive brief
WinRAR, a widely used file compression and archiving utility, is vulnerable to a flaw that allows a local user to crash the application. By placing a specially crafted language file in the program's installation folder, an attacker can cause the software to stop responding or shut down unexpectedly when performing standard archive tests. This results in a denial of service for the affected user but does not typically lead to data theft or unauthorized system access.
Technical details
A denial of service vulnerability exists in WinRAR 5.61 (32-bit) due to improper handling of language files (.lng). A local attacker with the ability to write to the application's installation directory can place a malformed 'winrar.lng' file to trigger an access violation. The crash occurs at memory address 004F1DB8 when a user opens an archive and clicks the 'Test' button, causing the application to attempt to read invalid data from the corrupted language file. While categorized under CWE-379 (Creation of Temporary File in Directory with Insecure Permissions) by some sources, the primary impact is an application-level crash (Access Violation).
Affected products
- RARLAB WinRAR 5.61 (32-bit) and earlier
Timeline
- 2019-02-20: disclosed: Initial discovery and exploit published on Exploit-DB
- 2026-04-05: advisory: NVD/VulnCheck advisory published