News
High-Severity Security Flaw Discovered in WinRAR Utility
A high-severity security flaw in the WinRAR utility has recently been disclosed. This vulnerability has the potential to be exploited by threat actors to achieve remote code execution on Windows systems.
The vulnerability, identified as CVE-2023-40477 with a CVSS score of 7.8, stems from improper validation during recovery volume processing. According to the Zero Day Initiative (ZDI), the lack of proper validation of user-supplied data can lead to a memory access past the end of an allocated buffer. This can enable an attacker to execute code in the context of the current process.
To successfully exploit this flaw, user interaction is required. The target must either visit a malicious page or open a booby-trapped archive file.
The vulnerability was discovered and reported by a security researcher known as goodbyeselene on June 8, 2023. It has since been addressed in the release of WinRAR 6.23 on August 2, 2023. The software maintainers have fixed the issue related to out of bounds write in the RAR4 recovery volumes processing code.
The latest version of WinRAR also resolves another issue where the software would start the wrong file after a user double-clicked an item in a specially crafted archive. This problem was reported by Andrey Polovinkin from Group-IB.
To mitigate potential threats, users are strongly advised to update to the latest version of WinRAR.
Follow us on Twitter and LinkedIn for more exclusive content we post.
The post High-Severity Security Flaw Discovered in WinRAR Utility appeared first on satProviders.