Serious WinRAR Flaw Can Be Exploited to Launch Malware

Popular archiving tool WinRAR has patched a serious flaw that could be exploited to launch malware on a user’s PC. 

Trend Micro’s Zero Day Initiative, a bug bounty program, disclosed the vulnerability on Thursday, warning it paves a way for a hacker to remotely attack PCs installed with WinRAR. BleepingComputer was first to report the news.  

The flaw involves WinRAR processing recovery volumes, which can be used to salvage partially damaged archive files. “The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer,” the Zero Day Initiative says. “An attacker can leverage this vulnerability to execute code in the context of the current process.”

The result can manipulate a PC into running rogue computer code, such as malware. Fortunately, the flaw has a key limitation: “User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file,” the Zero Day Initiative says. 

Even so, the vulnerability could pose a threat to numerous consumers. WinRAR has over 500 million users across the globe, and has become a go-to option to open a variety of archive files including the .RAR format. So it isn’t hard to imagine cybercriminals booby-trapping websites or files and then circulating them on the internet to phish unsuspecting users. 

The good news is that WinRAR moved quickly to patch the flaw with a software release earlier this month after a security researcher with the Zero Day Initiative discovered the vulnerability in June. The WinRAR team is now encouraging users to update to version 6.23 to protect their PCs.

Based on the Zero Day Initiative report, it doesn’t look like any malicious group was exploiting or ever learned of the flaw. Still, the vulnerability has been given a high 7.8 CVSS rating for severity, partially because the attack complexity is rated as “low.” That means it’s possible hackers could eventually uncover details of the flaw to target users running unpatched versions of WinRAR.