RARLAB WinRAR Code Execution Vulnerability (CVE-2023-38831)

What is affected, what to do

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update RARLAB WinRAR to version 6.23. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• RARLAB WinRAR lt *..6.23

Fixed in

• RARLAB WinRAR 6.23

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade to WinRAR 6.23 or later on every client and server. All versions before 6.23 are affected. Query your software inventory (SCCM/Intune, EDR asset view) for WinRAR.exe with a file version below 6.23. Include portable copies in user profiles (%USERPROFILE%\Downloads, %APPDATA%, network shares).
   • Where you cannot upgrade today, uninstall WinRAR or block it via AppLocker/WDAC. Reassign .zip/.rar file associations to Windows Explorer or another patched tool. WinRAR does not auto-update, so verify every instance you find.
   • Sweep your mail gateway and web proxy for recent ZIP/RAR attachments containing entries with a space before or after the extension (e.g. report.pdf alongside a folder report.pdf \ holding report.pdf .cmd). Quarantine any hits and identify the recipients.
   • Retro-hunt in EDR for child processes of WinRAR.exe (see Detection rules). Isolate affected endpoints, preserve forensic evidence, and reset credentials used on those hosts — especially browser-stored passwords, VPN, and banking/trading accounts.
   • Send a targeted user advisory: do not open archives from email, messengers, or forums with WinRAR until the upgrade is confirmed, and forward suspicious archives to the SOC.
2. 02

   Runbook step 2

   Mitigation layers

   • Application control (endpoint): add a WDAC/AppLocker publisher rule with a minimum version that blocks WinRAR below 6.23. Back it with an EDR custom block for child processes of WinRAR.exe: cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe.
   • Microsoft Defender ASR: set "Block executable content from email client and webmail" and "Block JavaScript or VBScript from launching downloaded executable content" to Block, not Audit. These rules break the common follow-on chains but do not fix the bug itself.
   • Mail/web filtering: reject or sandbox archives with double extensions, a space before the extension, or a file and folder sharing the same name. Quarantine password-protected external ZIP/RAR files by default.
   • Execution-path hardening: block script and binary execution from %TEMP%\Rar$DI* with an AppLocker path rule or an EDR path rule. This is the staging path the payload launches from.
   • Least privilege: remove local admin rights from standard users to contain code running in user context. Allow freeware such as WinRAR only through the sanctioned software catalogue.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / Security 4688): ParentImage ends with \WinRAR.exe and the child is a script host or LOLBin. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "WinRAR.exe" and FileName in~ ("cmd.exe","powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
   • File creation (Sysmon EID 11): TargetFilename contains \Rar$DI and matches a space-padded double extension, e.g. regex \.[A-Za-z0-9]{2,4} \.(cmd|bat|ps1|vbs|js|exe|scr)$. This combination is a high-fidelity exploitation indicator.
   • Command line: CommandLine contains \AppData\Local\Temp\Rar$DI together with .cmd or .bat. Sigma shape: selection: ParentImage|endswith: '\WinRAR.exe' and CommandLine|contains: 'Rar$DI'.
   • Network follow-on (Zeek/Suricata, EDR DeviceNetworkEvents): outbound connections from processes whose parent is WinRAR.exe, especially HTTP(S) downloads or traffic to newly registered domains shortly after an archive was opened.
   • Inventory drift: feed a recurring query (e.g. DeviceTvmSoftwareInventory | where SoftwareName has "winrar") into the SIEM to flag any version below 6.23 as a compliance signal.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

Source: pwn.watch, CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• RARLAB RARLAB WinRAR

Weakness classes (CWE)

• CWE-351Insufficient Type Distinction

  Base

  The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

  Entry at MITRE CWE-351

References & sources

• group-ib.comTraders' Dilemma: Unveiling CVE-2023-38831 WinRAR Zero-Daypwn-watch
• bleepingcomputer.comnews/security/winrar-zero-day-exploited-since-april-to-hack-tra…
• news.ycombinator.comitem?id=37236100
• packetstormsecurity.comfiles/174573/WinRAR-Remote-Code-Execution.html
• blog.googleGovernment-backed actors exploiting WinRAR vulnerabilitypwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831government-resource
• pwn.watchpwn.watch: WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)pwn-watch
• rarlab.comWinRAR what's newpwn-watch
• NVD (NIST)NVD: CVE-2023-38831pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch