# CVE-2019-25677: RARLAB WinRAR denial of service via malformed language file

Source: https://junglewise.ai/threats/cve-2019-25677-rarlab-winrar-denial-of-service-via-malformed-language-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2019-25677 · Severity: medium · CVSS 6.2 · Published 2026-04-05

WinRAR, a widely used file compression and archiving utility, is vulnerable to a flaw that allows a local user to crash the application. By placing a specially crafted language file in the program's installation folder, an attacker can cause the software to stop responding or shut down unexpectedly when performing standard archive tests. This results in a denial of service for the affected user but does not typically lead to data theft or unauthorized system access.

Technologies: [RARLAB WinRAR](https://junglewise.ai/threats/technologies/winrar). Vendors: [RARLAB](https://junglewise.ai/threats/vendors/rarlab).

## Quick answers

**Is CVE-2019-25677 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25677 being exploited in the wild.

**How severe is CVE-2019-25677?** Medium severity, with a CVSS score of 6.2, published 5 April 2026.

**Which products and versions are affected?** RARLAB WinRAR 5.61 (32-bit) and earlier.

**Is there a fix for CVE-2019-25677?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25677 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2019-25677?** Check whether you run RARLAB WinRAR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in WinRAR 5.61 (32-bit) due to improper handling of language files (.lng). A local attacker with the ability to write to the application's installation directory can place a malformed 'winrar.lng' file to trigger an access violation. The crash occurs at memory address 004F1DB8 when a user opens an archive and clicks the 'Test' button, causing the application to attempt to read invalid data from the corrupted language file. While categorized under CWE-379 (Creation of Temporary File in Directory with Insecure Permissions) by some sources, the primary impact is an application-level crash (Access Violation).

## Affected products

- RARLAB WinRAR 5.61 (32-bit) and earlier

## Timeline

- 2019-02-20: disclosed: Initial discovery and exploit published on Exploit-DB
- 2026-04-05: advisory: NVD/VulnCheck advisory published

## References

- [https://win-rar.com/predownload.html?spV=true&subD=true&f=wrar561tr.exe](https://win-rar.com/predownload.html?spV=true&subD=true&f=wrar561tr.exe)
- [https://www.exploit-db.com/exploits/46432](https://www.exploit-db.com/exploits/46432)
- [https://www.vulncheck.com/advisories/winrar-denial-of-service-via-malformed-language-file](https://www.vulncheck.com/advisories/winrar-denial-of-service-via-malformed-language-file)

## Related threats

- [RARLAB WinRAR and UnRAR heap overflow in RAR5 recovery-volume parser](https://junglewise.ai/threats/cve-2026-14191-rarlab-winrar-and-unrar-heap-overflow-in-rar5-recovery-volume)
- [RARLAB WinRAR path traversal and remote code execution](https://junglewise.ai/threats/cve-2025-6218-rarlab-winrar-path-traversal-and-remote-code-execution)
- [Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers…](https://junglewise.ai/threats/cve-2025-52331-cross-site-scripting-xss-vulnerability-in-the-generate-report)
- [RARLAB WinRAR path traversal](https://junglewise.ai/threats/cve-2025-8088-rarlab-winrar-path-traversal)
- [RARLAB WinRAR Code Execution Vulnerability](https://junglewise.ai/threats/cve-2023-38831-rarlab-winrar-code-execution-vulnerability)