Vendor
RARLAB
47 known vulnerabilities in products by RARLAB, 5 of them actively exploited (CISA KEV).
Key figures
47
Vulnerabilities
5
Actively exploited (KEV)
4
Used by ransomware
10
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-8088 | Path traversal vulnerability in WinRAR In CISA KEVRansomware | 8.8 | |
| Critical | CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability In CISA KEVRansomware | 7.8 | |
| Critical | CVE-2018-20250 | WinRAR Absolute Path Traversal Vulnerability In CISA KEVRansomwarealso in 1 other product | 7.8 | |
| Critical | CVE-2022-30333 | RARLAB UnRAR Directory Traversal Vulnerability In CISA KEVRansomwarealso in 1 other product | 7.5 | |
| Critical | CVE-2025-6218 | RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2012-6706 | RARLAB UnRAR: Out-of-Bounds Access | 9.8 | |
| High | CVE-2023-40477 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability | 7.8 | |
| High | CVE-2018-20253 | Check Point Software Technologies WinRAR: Out-of-bounds Write | 7.8 | |
| Medium | CVE-2018-20251 | Check Point Software Technologies WinRAR: Protection Mechanism Failure | 5.5 | |
| Critical | CVE-2017-12942 | RARLAB UnRAR: Buffer Overflow | 9.8 | |
| High | CVE-2014-125119 | WinRAR < 5.00 Filename Spoofing RCE | — | |
| Critical | CVE-2017-12941 | RARLAB UnRAR: Out-of-Bounds Read | 9.8 | |
| Critical | CVE-2017-12940 | RARLAB UnRAR: Out-of-Bounds Read | 9.8 | |
| High | CVE-2018-20252 | Check Point Software Technologies WinRAR: Out-of-bounds Write | 7.8 | |
| High | CVE-2017-12938 | RARLAB UnRAR: security vulnerability | 7.5 | |
| Critical | CVE-2017-14122 | RARLAB UnRAR: Buffer Over-read | 9.1 | |
| High | CVE-2022-43650 | RARLAB WinRAR: Out-of-bounds Read | 2.5 | |
| High | CVE-2017-14120 | RARLAB UnRAR: Path Traversal | 7.5 | |
| Medium | CVE-2025-31334 | RARLAB WinRAR: Product UI does not Warn User of Unsafe Actions | 6.8 | |
| High | CVE-2018-25018 | RARLAB UnRAR: Out-of-Bounds Write | 7.8 | |
| High | CVE-2017-20006 | RARLAB UnRAR: Heap-Based Buffer Overflow | 7.8 | |
| Medium | CVE-2014-9983 | RAR: Path Traversal | 5.5 | |
| Not rated | CVE-2004-1254 | RARLAB WinRAR: Buffer Overflow | — | |
| Not rated | CVE-2004-0234 | Tsugio Okamoto Lha: Stack-Based Buffer Overflow | — | |
| Not rated | CVE-2005-3262 | RARLAB WinRAR: XML External Entity (XXE) | — |
News
- 19th October – Threat Intelligence Reportcheckpoint-research,
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizationscisco-talos,
- Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgsdarkreading,
- WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukrainethehackernews,
- Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukrainethehackernews,
Products
| RARLAB WinRAR | 30 | 4 |
| RARLAB UnRAR | 15 | 1 |
| RAR | 3 | 0 |