CVE-2025-8088 — Rarlab Winrar

What is CVE-2025-8088?

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

The record classifies CVE-2025-8088 under weakness class CWE-35. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs a user to take an action first, and has high impact on confidentiality, integrity, availability. 3 affected-product entries are recorded, across 3 vendors, listed below. The identifier was first published 446 days ago.

Severity and exploitation probability

CVSS v3.1 base score

8.8 — HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v4.0 base score

8.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (FIRST)

94.2% probability of exploitation in the next 30 days, higher than 99.8% of all scored CVEs

CISA KEV

Listed since 2025-08-12, federal remediation deadline 2025-09-02 — used in known ransomware campaigns

Threadlinqs priority

10/10 — CISA lists it as used in ransomware, which Threadlinqs scores at the maximum

Published

2025-08-08, last modified 2026-08-11

Is CVE-2025-8088 being exploited?

CISA added CVE-2025-8088 to the Known Exploited Vulnerabilities catalog on 2025-08-12, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2025-09-02 under BOD 22-01. CISA flags the vulnerability as one used in known ransomware campaigns. Weaponised exploit code for CVE-2025-8088 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 58 in the Threadlinqs vulnerability feed.

• sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit- (github)
• onlytoxi/CVE-2025-8088-Winrar-Tool (github)
• hexsecteam/CVE-2025-8088-Winrar-Tool (github)
• knight0x07/WinRAR-CVE-2025-8088-PoC-RAR (github)
• pentestfunctions/CVE-2025-8088-Multi-Document (github)
• aldisakti2/CVE-2025-8088-BUILDER-Winrar-Tool (github)
• AdityaBhatt3010/CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal (github)
• jordan922/CVE-2025-8088 (github)

Affected products and versions

• Rarlab: Winrar
• Microsoft: Windows
• Dtsearch: Dtsearch

How to fix CVE-2025-8088

Because CVE-2025-8088 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2025-09-02. No vendor patch reference has been recorded for CVE-2025-8088 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2025-8088

12 tracked threats in the Threadlinqs corpus reference CVE-2025-8088, either in the campaign’s CVE list or as an indicator on the campaign record.

• Q2 2026 Vulnerability and Exploit Landscape: Exploited AI-platform flaws (OpenClaw CVE-2026-25253, Dify CVE-2026-41948, Open WebUI CVE-2026-45386), Exchange CVE-2026-45501, and Linux kernel page-cache LPE exploit wave (Copy Fail, Dirty Frag) — HIGH · 2026-10-20
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns — HIGH · 2026-10-18
• Talos Q3 2026 Vulnerability Pulse: Ivanti Connect Secure Zero-Day CVE-2026-104935, SonicWall SMA1000 SSRF CVE-2026-102255, and UAT-6275 (Silent Lynx) Espionage — HIGH · 2026-10-15
• Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257) — HIGH · 2026-10-14
• Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now Exploiting CVE-2025-8088 (WinRAR) — HIGH · 2026-07-11
• Gamaredon Expands Ukraine Attacks with PteroSetup Revival and Cloud Service Abuse, Exploiting WinRAR Flaw CVE-2025-8088 — HIGH · 2026-06-29
• Turla STOCKSTAY .NET Backdoor Targeting Ukraine Government and Military via CVE-2025-8088 — HIGH · 2026-06-28
• Russian APT Gamaredon Upgrades Arsenal with Six New PowerShell Downloaders, Cloudflare/Devtunnel C2 Concealment, and Turla Collaboration Delivering Kazuar Backdoor (2025) — HIGH · 2026-06-28
• Russia-aligned Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) Exploit Patched WinRAR Path-Traversal CVE-2025-8088 (NTFS ADS) Against Ukrainian Organizations — HIGH · 2026-06-09
• Gamaredon (Russia/FSB) "GammaWorm" — VBScript Worm Hidden in NTFS ADS with Cloud-Service Dead Drop Resolver C2 (Gamma Toolset) vs Ukraine, WinRAR CVE-2025-8088 Initial Access — HIGH · 2026-06-02
• UAC-0252 SHADOWSNIFF & SALATSTEALER — Credential Theft Campaign Impersonating Ukrainian Government via GitHub-Hosted Payloads and XSS Delivery — HIGH · 2026-03-02
• RomCom & Paper Werewolf Exploiting WinRAR CVE-2025-8088 Zero-Day via ADS Path Traversal — CRITICAL · 2026-02-04

Sources

Enriched from CVE.org, NVD, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10. This product uses the NVD API but is not endorsed or certified by the NVD.

Other references

• win-rar.com
• arstechnica.com
• support.dtsearch.com
• vicarius.io
• vicarius.io (cve 2025 8088 mitigate winrar zero day u)

Showing 5 of 7 recorded references.