{"id":8105,"date":"2019-02-21T10:18:50","date_gmt":"2019-02-21T10:18:50","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=8105"},"modified":"2026-04-17T18:07:55","modified_gmt":"2026-04-17T18:07:55","slug":"winrar-code-execution-vulnerability-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/winrar-code-execution-vulnerability-threat-alert\/","title":{"rendered":"WinRAR Code Execution Vulnerability Threat Alert"},"content":{"rendered":"


\n<\/p>\n

1 Vulnerability Overview<\/strong><\/h2>\n

Recently, a security researcher found a logical bug in WinRAR using the WinAFL fuzzer and exploited it to gain full control over a victim’s computer. An attacker could exploit this vulnerability by crafting an archive and then tricking victims into downloading it by means of a phishing email, net disk, or forum. When a victim opens this malicious file with WinRAR, the attack is complete.<\/p>\n

The vulnerability exists in UNACEV2.dll in WinRAR, which does not properly sanitize file names when decompressing .ace files, leading to directory traversal. This indicates that an attacker could write a malicious file to an arbitrary path, thus making it possible to plant a backdoor trojan. This vulnerability has been in WinRAR for more than 19 years. Now WinRAR has to completely stop supporting the vulnerable format (.ace).<\/p>\n

WinRAR is a Windows data compression\/decompression tool that can be used to create and view RAR or ZIP compression files and decompress files of various compression formats. As the most popular compression tool, WinRAR has more than 500 million users around the world.<\/p>\n

Reference link:<\/p>\n

https:\/\/research.checkpoint.com\/extracting-code-execution-from-winrar\/<\/p>\n

2 Scope of Impact<\/strong><\/h2>\n