# CVE-2026-14191: RARLAB WinRAR and UnRAR heap overflow in RAR5 recovery-volume parser

Source: https://junglewise.ai/threats/cve-2026-14191-rarlab-winrar-and-unrar-heap-overflow-in-rar5-recovery-volume  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-14191 · Severity: high · CVSS 7.8 · Published 2026-07-01

WinRAR and UnRAR are popular file compression and extraction utilities used to manage archives. A vulnerability in how these tools handle RAR5 recovery volumes (.rev files) could allow an attacker to execute malicious code or crash the application. To exploit this, an attacker must trick a user into opening or repairing a specially crafted set of recovery files.

Technologies: [RARLAB WinRAR](https://junglewise.ai/threats/technologies/winrar). Vendors: [RARLAB](https://junglewise.ai/threats/vendors/rarlab).

## Quick answers

**Is CVE-2026-14191 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14191 being exploited in the wild.

**How severe is CVE-2026-14191?** High severity, with a CVSS score of 7.8, published 1 July 2026.

**Which products and versions are affected?** RARLAB RAR < 7.23; RARLAB UnRAR <= 7.21; RARLAB UnRAR.dll < 7.23; RARLAB WinRAR < 7.23.

**Is there a fix for CVE-2026-14191?** A patch was published on 2026-07-01: Fixed in version 7.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14191 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-14191?** Check whether you run RARLAB RAR, RARLAB UnRAR, RARLAB UnRAR.dll or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds (OOB) heap write exists in the RecVolumes5::ReadHeader function within recvol5.cpp. The vulnerability stems from improper validation of the RecNum value in multi-file recovery sets; while the RecItems vector is sized based on the first .rev file, subsequent files provide a RecNum that is validated against their own internal TotalCount but not against the actual allocated size of RecItems. An attacker can provide a crafted set of two or more .rev files to write a controlled 32-bit value (RevCRC) to an OOB offset up to approximately 64KB past the buffer. This can be triggered during archive repair, testing, or auto-recovery operations. The issue is fixed in WinRAR/RAR version 7.23.

## Affected products

- RARLAB WinRAR < 7.23
- RARLAB RAR < 7.23
- RARLAB UnRAR <= 7.21
- RARLAB UnRAR.dll < 7.23

## Timeline

- 2026-07-01: disclosed: CVE-2026-14191 published
- 2026-07-01: patched: Fixed in version 7.23

## References

- [https://www.rarlab.com/download.htm](https://www.rarlab.com/download.htm)

## Related threats

- [RARLAB WinRAR denial of service via malformed language file](https://junglewise.ai/threats/cve-2019-25677-rarlab-winrar-denial-of-service-via-malformed-language-file)
- [RARLAB WinRAR path traversal and remote code execution](https://junglewise.ai/threats/cve-2025-6218-rarlab-winrar-path-traversal-and-remote-code-execution)
- [Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers…](https://junglewise.ai/threats/cve-2025-52331-cross-site-scripting-xss-vulnerability-in-the-generate-report)
- [RARLAB WinRAR path traversal](https://junglewise.ai/threats/cve-2025-8088-rarlab-winrar-path-traversal)
- [RARLAB WinRAR Code Execution Vulnerability](https://junglewise.ai/threats/cve-2023-38831-rarlab-winrar-code-execution-vulnerability)