CVE-2026-14191: RARLAB WinRAR and UnRAR heap overflow in RAR5 recovery-volume parser

CVE-2026-14191 · Severity: high · CVSS 7.8 · Published 2026-07-01

WinRAR and UnRAR are popular file compression and extraction utilities used to manage archives. A vulnerability in how these tools handle RAR5 recovery volumes (.rev files) could allow an attacker to execute malicious code or crash the application. To exploit this, an attacker must trick a user into opening or repairing a specially crafted set of recovery files.

Technologies: RARLAB WinRAR. Vendors: RARLAB.

Quick answers

Is CVE-2026-14191 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-14191 being exploited in the wild.
How severe is CVE-2026-14191?
High severity, with a CVSS score of 7.8, published 1 July 2026.
Which products and versions are affected?
RARLAB RAR < 7.23; RARLAB UnRAR <= 7.21; RARLAB UnRAR.dll < 7.23; RARLAB WinRAR < 7.23.
Is there a fix for CVE-2026-14191?
A patch was published on 2026-07-01: Fixed in version 7.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14191 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-14191?
Check whether you run RARLAB RAR, RARLAB UnRAR, RARLAB UnRAR.dll or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) heap write exists in the RecVolumes5::ReadHeader function within recvol5.cpp. The vulnerability stems from improper validation of the RecNum value in multi-file recovery sets; while the RecItems vector is sized based on the first .rev file, subsequent files provide a RecNum that is validated against their own internal TotalCount but not against the actual allocated size of RecItems. An attacker can provide a crafted set of two or more .rev files to write a controlled 32-bit value (RevCRC) to an OOB offset up to approximately 64KB past the buffer. This can be triggered during archive repair, testing, or auto-recovery operations. The issue is fixed in WinRAR/RAR version 7.23.

Affected products

  • RARLAB WinRAR < 7.23
  • RARLAB RAR < 7.23
  • RARLAB UnRAR <= 7.21
  • RARLAB UnRAR.dll < 7.23

Timeline

  • 2026-07-01: disclosed: CVE-2026-14191 published
  • 2026-07-01: patched: Fixed in version 7.23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.