HighPublic exploit

Remote Code Execution in WinRAR Recovery Volume Processing

IdentifiersCVE-2023-40477CWE-129· Improper Validation of Array Index

CVE-2023-40477 is a remote code execution vulnerability in RARLAB WinRAR involving the processing of recovery volumes. The flaw stems from improper validation of user-supplied array index data while handling recovery-volume content, leading to a memory access past the end of an allocated buffer. This out-of-bounds memory operation can corrupt process memory and is exploitable in the context of archive parsing. Successful exploitation occurs when a target opens a specially crafted archive-related file or otherwise causes WinRAR to process attacker-controlled recovery-volume data, allowing arbitrary code execution in the context of the current WinRAR process.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow arbitrary code execution in the security context of the user running WinRAR. Because the flaw is a memory corruption issue triggered during parsing of attacker-controlled recovery-volume data, exploitation may enable full compromise of the affected user session, including execution of malicious payloads, installation of additional malware, access to user-accessible data, and follow-on activity using the victim's privileges.

Mitigation

If you can’t patch tonight, do this now.

Until patching is complete, reduce exposure by preventing users from opening untrusted or unsolicited archive content, especially files intended to trigger recovery-volume processing. Restrict use of WinRAR and UnRAR components to systems where they are operationally required, and remove or disable them where unnecessary. Apply attachment filtering, sandboxing, and detonation controls for archive content, and use application control or endpoint protections to limit post-exploitation payload execution from user space.

Remediation

Patch, then assume compromise.

Update WinRAR to a vendor-fixed release that addresses CVE-2023-40477. Any software embedding or bundling the affected UnRAR codebase should also be updated to a version incorporating the corrected library. Validate that all endpoints and packaged applications using WinRAR or UnRAR components have received the patched version, as downstream consumers may remain vulnerable even after the primary desktop application is updated.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

Winrar-CVE-2023-40477-POCMaturityPoCVerified exploit

This repository provides a proof-of-concept (PoC) exploit for CVE-2023-40477, a heap overflow vulnerability in WinRAR versions up to 6.22. The main exploit file is 'cve_2023_40477_poc.py', a Python script that generates a set of malformed RAR recovery volume files (.rev). The exploit process involves creating a RAR4 archive with recovery volumes, deleting the first recovery volume (.r01), and then using the script to generate malformed .rev files. When a vulnerable version of WinRAR attempts to extract the archive with these files, it will crash, demonstrating the vulnerability. The repository also includes a set of example RAR recovery volume files in the 'example_poc_after_gen' directory, which can be used directly for testing. The exploit is local in nature, requiring the user to interact with the crafted archive files. No network endpoints or remote attack vectors are present. The repository is structured with a README providing detailed instructions, the PoC script, and example files for demonstration.

wildptr-ioDisclosed Aug 29, 2023pythonlocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

WinRARWinrarapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

malwarebytes labsNews

Jul 2, 2026

WinRAR flaw could allow attackers to take control of your computer | Malwarebytes

A 2023 WinRAR recovery-volume handling flaw referenced as a variant related to CVE-2026-14191.

linuxsecurityNews

Jun 23, 2026

Understanding Security Weaknesses and Regulatory Compliance Gaps

The content only mentions this CVE as part of a recent searches list and provides no vulnerability details or significance.

clamav blogNews

Aug 28, 2023

ClamAV® blog: ClamAV 1.2.0 feature version and 1.1.2, 1.0.3, 0.103.10 patch versions published

A vulnerability in the UnRAR library that may affect ClamAV because it bundles UnRAR as libclamunrar; the issue prompted critical patch releases and an upgrade to UnRAR/libclamunrar version 6.2.10.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3