UN
Product
UnRAR
On CISA KEVExploited in the wildRansomware-linked
16
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 8Medium 1Low 0
Watch
Add UnRAR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-30333 RansomwareIn wildKEV | 7.5 | May 9 | RARLAB UnRAR Directory Traversal Vulnerability Affected: before 6.12 |
| CVE-2026-14191 | 7.8 | Jul 1 | WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader Affected: through 7.21 |
| CVE-2018-25018 | 7.8 | Jul 1 | UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext Affected: 5.6.1.7 through 5.7.4; 6.0.3 |
| CVE-2017-20006 | 7.8 | Jul 1 | UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrentFile) Affected: 5.6.1.2; 5.6.1.3 |
| CVE-2022-48579 | 7.5 | Aug 7 | UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains Affected: before 6.2.3 |
| CVE-2017-14120 | 7.5 | Sep 3 | unrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a directory traversal vulnerability for RAR v2 archives: pathnames of the form ../[filename] are unpacked into the upper… Affected: 0.0.1 |
| CVE-2017-12938 | 7.5 | Aug 18 | UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the Affected: through 5.5.6 |
| CVE-2024-33899 | 7.1 | Apr 28 | RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences Affected: through 6.24 |
Showing 8