# CVE-2023-38831: RARLAB WinRAR Code Execution Vulnerability

Source: https://junglewise.ai/threats/cve-2023-38831-rarlab-winrar-code-execution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-08-24. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2023-38831 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2023-08-24

RARLAB WinRAR versions prior to 6.23 contain a vulnerability where executable content within a folder can be processed when a user attempts to view a benign file of the same name within a ZIP archive. This flaw allows attackers to execute arbitrary code by spoofing file extensions in specially crafted archives.

Technologies: [RARLAB WinRAR](https://junglewise.ai/threats/technologies/winrar). Vendors: [RARLAB](https://junglewise.ai/threats/vendors/rarlab).

## Quick answers

**Is CVE-2023-38831 exploited in the wild?** Yes. CVE-2023-38831 is known to be exploited in the wild, first recorded on 24 August 2023. Treat it as urgent.

**How severe is CVE-2023-38831?** Critical severity, with a CVSS score of 7.8, published 24 August 2023.

**Which products and versions are affected?** RARLAB WinRAR before 6.23.

**Is there a fix for CVE-2023-38831?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2023-38831 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2023-38831?** Check whether you run RARLAB WinRAR. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- RARLAB WinRAR before 6.23

## Timeline

- 2023-04: exploited: Earliest reported exploitation in the wild.
- 2023-08-24: disclosed: Initial publication date and addition to CISA KEV catalog.
- 2023-08-24: kev added

## Related threats

- [RARLAB WinRAR and UnRAR heap overflow in RAR5 recovery-volume parser](https://junglewise.ai/threats/cve-2026-14191-rarlab-winrar-and-unrar-heap-overflow-in-rar5-recovery-volume)
- [RARLAB WinRAR denial of service via malformed language file](https://junglewise.ai/threats/cve-2019-25677-rarlab-winrar-denial-of-service-via-malformed-language-file)
- [RARLAB WinRAR path traversal and remote code execution](https://junglewise.ai/threats/cve-2025-6218-rarlab-winrar-path-traversal-and-remote-code-execution)
- [Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers…](https://junglewise.ai/threats/cve-2025-52331-cross-site-scripting-xss-vulnerability-in-the-generate-report)
- [RARLAB WinRAR path traversal](https://junglewise.ai/threats/cve-2025-8088-rarlab-winrar-path-traversal)