WinRAR Code Execution Vulnerability (CVE-2023-40477)

A Remote Code Execution Vulnerability (CVE-2023-40477) was identified in WinRAR recently which allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR.

RARLAB has released an update, WinRAR version 6.23, to fix the vulnerability and strongly recommends customers to apply the update IMMEDIATELY.

Vulnerability

• Remote Code Execution Vulnerability (CVE-2023-40477)

Severity Level

• High

Affected Product

• WinRAR

Remediation

• Please apply the latest update patches in your department devices immediately.

Reference

• https://www.win-rar.com/singlenewsview.html?&L=0
• https://www.zerodayinitiative.com/advisories/ZDI-23-1152/
• https://www.bleepingcomputer.com/news/security/winrar-flaw-lets-hackers-run-programs-when-you-open-rar-archives/?&web_view=true
• https://twitter.com/WinRAR_RARLAB/status/1692497692834828289

Enquiry

• For enquiries, please contact infosec@cuhk.edu.hk. Thanks a lot.

Published on: 22 Aug 2023