Executive brief
WinRAR and UnRAR are popular file compression and extraction utilities used to manage archives. A vulnerability in how these tools handle RAR5 recovery volumes (.rev files) could allow an attacker to execute malicious code or crash the application. To exploit this, an attacker must trick a user into opening or repairing a specially crafted set of recovery files.
Technical details
An out-of-bounds (OOB) heap write exists in the RecVolumes5::ReadHeader function within recvol5.cpp. The vulnerability stems from improper validation of the RecNum value in multi-file recovery sets; while the RecItems vector is sized based on the first .rev file, subsequent files provide a RecNum that is validated against their own internal TotalCount but not against the actual allocated size of RecItems. An attacker can provide a crafted set of two or more .rev files to write a controlled 32-bit value (RevCRC) to an OOB offset up to approximately 64KB past the buffer. This can be triggered during archive repair, testing, or auto-recovery operations. The issue is fixed in WinRAR/RAR version 7.23.
Affected products
- RARLAB WinRAR < 7.23
- RARLAB RAR < 7.23
- RARLAB UnRAR <= 7.21
- RARLAB UnRAR.dll < 7.23
Timeline
- 2026-07-01: disclosed: CVE-2026-14191 published
- 2026-07-01: patched: Fixed in version 7.23