CVE-2026-14191: WinRAR & UnRAR RAR5 Recovery Volume Heap Overflow – Patch Now

Technical summary

The vulnerability exists in the RecVolumes5::ReadHeader function in recvol5.cpp. The RecItems vector is allocated only during processing of the first .rev file in a recovery set. Subsequent .rev files each provide an independent RecNum value that is validated only against that specific file's TotalCount field, not against the actual RecItems vector size. An attacker can craft a multi-file .rev set where a second (or later) file specifies a RecNum that, while seemingly valid within that file's local context, causes an out-of-bounds write when the code indexes into the undersized RecItems vector. The attacker controls the data written (the RevCRC field, a 32-bit value) and the offset (up to approximately 4 MB past the allocation, depending on RecNum magnitude). This is the RAR5 equivalent of CVE-2023-40477, which was previously patched only in the RAR3 parsing code.

Business impact

Organizations distributing or accepting .rar/.rev files (common in software distribution, backup systems, and legacy archive sharing) face risk if users run repair, test, or extraction operations on attacker-supplied recovery volumes. Affected operations include manual 'Repair archive' in WinRAR, 'unrar t' test commands, and automatic recovery triggered during volume set extraction. Successful exploitation can lead to information leakage from the application's memory, silent data corruption in processed archives, or potentially arbitrary code execution if the corrupted heap object is leveraged for further exploitation. The impact is heightened in automated or batch processing scenarios where users may not notice unusual behavior.

Affected systems

WinRAR versions prior to 7.23 and UnRAR versions prior to 7.23 are vulnerable. The vulnerability is specific to RAR5 recovery volume handling; RAR3 recovery volumes are not affected by this particular bug (though CVE-2023-40477 was a related RAR3 issue). Any system with WinRAR or UnRAR installed that processes untrusted .rar volume sets with .rev recovery files is at risk. This includes Windows, macOS, Linux, and other platforms where UnRAR is available.

Exploitability

Exploitation requires user interaction: a victim must deliberately run a repair, test, or recovery operation on an attacker-supplied .rev file set. This is a moderate barrier compared to purely network-based attacks, but not uncommon in environments where users regularly handle archives or where automated tools process user-supplied files. The attacker's control is high—they can choose both the offset (via RecNum) and the value written (via RevCRC)—but the predictability of what data structure lies at that offset introduces uncertainty in reliable exploitation. The CVSS score of 7.8 reflects high impact (confidentiality, integrity, and availability all marked as 'High') tempered by the local attack vector and user interaction requirement.

Remediation

Upgrade WinRAR to version 7.23 or later, and upgrade UnRAR to version 7.23 or later. If immediate patching is not feasible, treat untrusted .rar volume sets and .rev recovery files as high-risk. Disable automatic recovery features in WinRAR settings if processing untrusted archives. Avoid running 'unrar t' or repair operations on recovery volumes from unknown sources until patched. Consider restricting file type handling or running archive operations in isolated environments for high-risk workflows.

Patch guidance

WinRAR and UnRAR version 7.23 and later contain the fix. Verify the installed version in WinRAR via Help > About, or via 'unrar -v' from the command line. Update through official channels: WinRAR from win-rar.com, and UnRAR through your package manager or source.rarlab.com. Test patches in a non-production environment first, particularly if you rely on recovery volume functionality, to ensure no regressions in your workflows.

Detection guidance

Monitor for execution of 'unrar t' or similar test/repair commands against .rev files, especially if the .rev files are from external or untrusted sources. Log archive repair operations initiated through WinRAR's GUI. Look for unexpected process behavior or crashes in WinRAR/UnRAR with specific .rev file inputs—crashes involving heap corruption may produce memory-related error messages. File integrity monitoring on archives being processed can detect silent corruption. Intrusion detection signatures should look for .rev files delivered alongside .rar volumes in suspicious contexts (email attachments, downloads, etc.).

Why prioritize this

This vulnerability merits urgent patching because it affects a widely used, legacy format handler, requires only user interaction (not network access), and can result in complete compromise of file integrity and potential code execution. The RAR format remains common in enterprise backup systems, software distribution, and legacy file sharing. The fact that a nearly identical vulnerability (CVE-2023-40477) was patched in RAR3 but RAR5 was missed suggests the fix was incomplete, increasing the likelihood that defenders overlooked this variant. High-risk priority for any organization processing untrusted .rar archives or running automated recovery operations.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) Local attack vector—attacker must supply files the victim processes; (2) Low complexity—no special conditions or privilege bypass needed; (3) No privileges required; (4) User interaction mandatory—repair/test operation must be triggered; (5) All three impact categories (CIA) marked High due to potential for information leak, archive corruption, and code execution. The score does not incorporate exploit availability or prevalence, which remain unknown; however, the technical simplicity and moderate barrier to exploitation suggest attack feasibility once the vulnerability becomes widely known.

Frequently asked questions