CVE-2023-38831 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2023-08-24
RARLAB WinRAR versions prior to 6.23 contain a vulnerability where executable content within a folder can be processed when a user attempts to view a benign file of the same name within a ZIP archive. This flaw allows attackers to execute arbitrary code by spoofing file extensions in specially crafted archives.
Yes. CVE-2023-38831 is known to be exploited in the wild, first recorded on 24 August 2023. Treat it as urgent.
How severe is CVE-2023-38831?
Critical severity, with a CVSS score of 7.8, published 24 August 2023.
Which products and versions are affected?
RARLAB WinRAR before 6.23.
Is there a fix for CVE-2023-38831?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-38831 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2023-38831?
Check whether you run RARLAB WinRAR. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
RARLAB WinRAR before 6.23
Timeline
2023-04: exploited: Earliest reported exploitation in the wild.
2023-08-24: disclosed: Initial publication date and addition to CISA KEV catalog.