WinRAR fixes High Severity RCE Vulnerability

WinRAR has fixed a high-severity vulnerability, tracked as CVE-2023-40477 with a CVSS score 7.8, that can allow remote execution of arbitrary code on a computer by opening a crafted RAR archive.

The vulnerability exists within the processing of recovery volumes and is caused by the lack of proper validation of user-supplied data.

The vulnerability was reported to RARLAB on June 8th, 2023, by researcher “goodbyeselene” of the Zero Day Initiative.

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

WinRAR addressed the flaw with the release of version 6.23. Users are recommended to update their installs before threat actors exploit the flaw