Threat reportVulnerabilityTL-2026-1063
WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume Processing (CVE-2026-14191)
WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume (TL-2026-1063) is a medium-severity software vulnerability scored CVSS 7.8, first published 2026-07-02. It has no confirmed attribution, affects RARLAB WinRAR, references 2 CVEs (CVE-2026-14191, CVE-2023-40477), maps to 16 MITRE ATT&CK techniques (T1027, T1036.008, T1068), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 7.8/10Medium
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1063
- Threat ID
- TL-2026-1063
- Severity
- MEDIUM
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors using winrar rar unrar, managed file transfer, email security gateway, backup and archival, software supply chain tooling
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
How WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume works
WinRAR, RAR, and UnRAR before 7.23 contain a heap out-of-bounds write (CWE-787/CWE-129) in the RAR5 recovery-volume (.rev) parser, reachable when a victim runs a recovery, test, or auto-repair operation on an attacker-crafted .rev set. No public PoC or in-the-wild exploitation has been observed; RARLAB shipped a fix in version 7.23.
CVE-2026-14191 is an out-of-bounds heap write vulnerability discovered by Arjun Basnet of Securin Labs (with additional credit to researcher 'scofaild23-bnomran') in the RAR5 recovery-volume reconstruction logic implemented in RecVolumes5::ReadHeader (recvol5.cpp). The RecItems vector that tracks recovery-volume metadata is sized only once, when the first .rev file in a multi-volume recovery set is parsed. Every subsequent .rev file in the set supplies its own independent RecNum index value, and that value is validated only against the current file's own TotalCount field -- never against the actual allocated size of the RecItems vector established from the first file. By crafting a second (or later) .rev file with a RecNum far larger than the original allocation, an attacker can force the parser to write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum], an out-of-bounds offset that can reach up to 65534 * sizeof(RecVolItem) bytes past the end of the allocation. This corrupts adjacent heap objects and, depending on heap layout, allocator behavior, and platform mitigations (ASLR/DEP/heap hardening), can be leveraged for denial of service or, in a worst case, arbitrary code execution.
Exploitation is not automatic on file receipt: the vulnerable code path only runs when the victim explicitly triggers a recovery/repair/test action against a malicious .rev volume set, for example `unrar t x.part1.rev`, WinRAR's 'Repair archive' function, or WinRAR's automatic archive-recovery prompt that appears when extracting a RAR volume set with a missing .rar part. This makes social engineering (bundling a poisoned .rev set with an otherwise-legitimate multi-volume archive and prompting the user to repair/test it) the primary realistic delivery path, and it is a particular concern for unattended automation -- mail gateways, backup/archival pipelines, and file-processing services that auto-verify or auto-repair inbound archives.
The flaw is the RAR5-format sibling of CVE-2023-40477 (ZDI-23-1152, CWE-129), a near-identical out-of-bounds recovery-volume index validation bug that was previously fixed only in the legacy RAR3 recovery-volume code path in WinRAR 6.23 (August 2023). CVE-2026-14191 shows that the equivalent RAR5-path logic was left unpatched for roughly three years until RARLAB's July 2026 release. NVD lists WinRAR (Windows) < 7.23, RAR (Windows/Linux/macOS) < 7.23, UnRAR (Windows/Linux/macOS) <= 7.21, and UnRAR.dll (Windows) < 7.23 as affected products; RARLAB's own release notes state UnRAR.dll is not affected because it does not implement recovery-volume processing at all -- a discrepancy between the NVD product list and the vendor's own scoping that defenders relying on UnRAR.dll-only integrations should independently verify.
WinRAR 7.23 also shipped two unrelated hardening fixes in the same release: a further check preventing symbolic-link-based path traversal outside the extraction destination (closing a residual bypass even across multiple extraction commands), and an update of the bundled 7zxa.dll (7-Zip decoder) component to upstream version 26.02 to pick up unspecified 7-Zip bug and vulnerability fixes.
MITRE ATT&CK techniques used in TL-2026-1063
Defense Evasion
T1027 Obfuscated Files or Information; T1036.008 Masquerade File Type; T1211 Exploitation for Stealth
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Execution
T1203 Exploitation for Client Execution; T1204 User Execution; T1204.002 Malicious File
Impact
T1499 Endpoint Denial of Service
Discovery
Initial Access
T1566 Phishing; T1566.001 Spearphishing Attachment
Resource Development
T1587 Develop Capabilities; T1587.001 Malware; T1588.006 Vulnerabilities; T1608.001 Upload Malware
Reconnaissance
Affected products and versions in WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume
- RARLAB — WinRAR
Vulnerable versions: < 7.23
Fixed in: 7.23 - RARLAB — RAR (command-line, Windows/Linux/macOS)
Vulnerable versions: < 7.23
Fixed in: 7.23 - RARLAB — UnRAR (Windows/Linux/macOS)
Vulnerable versions: <= 7.21
Fixed in: 7.22 / 7.23 - RARLAB — UnRAR.dll (Windows)
Vulnerable versions: listed as < 7.23 by NVD; vendor states UnRAR.dll does not implement recovery-volume processing and is not affected
Fixed in: 7.23
Remediation for WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume
Patches
- WinRAR / RAR / UnRAR 7.23 (fixes RAR5 recovery-volume heap overflow, symbolic-link path-traversal hardening, 7zxa.dll updated to 26.02)
Immediate actions
- Upgrade WinRAR, command-line RAR, and UnRAR to version 7.23 or later on all Windows, Linux, and macOS hosts
- Block or quarantine inbound .rev (RAR5 recovery volume) files at email gateways and file-upload pipelines pending patch verification
- Disable or restrict automated archive 'repair'/'test'/auto-recovery functionality in backup and mail-processing pipelines that call vulnerable RAR/UnRAR binaries
- Inventory all hosts and automation services (backup jobs, CI pipelines, mail gateways, malware sandboxes) that invoke rar.exe, unrar, or WinRAR.exe against untrusted archive input
Workarounds
- Avoid running 'Repair archive', 'test', or recovery operations against RAR5 volume sets received from untrusted or unauthenticated sources
- Strip or block .rev file attachments/uploads until all endpoints are confirmed patched to 7.23+
Longer-term hardening
- Establish a recurring patch-verification process for archive utilities used in unattended/automated pipelines, given the historical pattern (CVE-2023-40477 -> CVE-2026-14191) of format-specific sibling bugs surviving prior fixes
- Prefer sandboxed or containerized archive extraction/repair for any untrusted or internet-sourced archive content
- Deploy endpoint heap-corruption / memory-safety mitigations (CFG, ASLR, DEP, DoubleCheck-style heap hardening) on hosts that process untrusted archives
CVEs associated with WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume
Weaknesses (CWE) in WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume
Timeline of WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume
- RARLAB releases WinRAR 6.23, fixing the RAR3-format sibling recovery-volume index-validation bug CVE-2023-40477 (ZDI-23-1152), but leaves the equivalent RAR5-path logic unpatched
- ZDI publicly discloses ZDI-23-1152 / CVE-2023-40477 (RAR3 recovery-volume improper array-index validation, CWE-129) via advisory and GitHub Security Advisory GHSA-58vr-f4x9-3h36, establishing the vulnerability pattern later found to also affect the RAR5 code path
- CVE-2026-14191 identifier reserved
- RARLAB credits Arjun Basnet of Securin Labs (and researcher scofaild23-bnomran) for responsible disclosure of the recovery-volume and symlink issues
- RARLAB ships WinRAR/RAR/UnRAR 7.23, fixing the RAR5 recovery-volume heap overflow along with symbolic-link path-traversal hardening and a 7zxa.dll update to 26.02
- NVD record for CVE-2026-14191 last modified at 14:16:39 UTC, same-day as initial publication
- CVE-2026-14191 published to NVD with CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CWE-787 and CWE-129
- CVE-2026-14191 confirmed absent from the CISA Known Exploited Vulnerabilities catalog; no public PoC or in-the-wild exploitation identified as of this analysis
- Cyber Security News publishes coverage of the WinRAR 7.23 fixes and CVE-2026-14191
Sources cited for WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume
- WinRAR 7.23 Fixes Heap Overflow Vulnerability
- CVE-2026-14191: CWE-787 Out-of-bounds Write in RARLAB WinRAR - Threat Radar
- WinRAR What's New / Changelog (7.23)
- RARLAB WinRAR/RAR download page
- NVD - CVE-2026-14191
- CISA Known Exploited Vulnerabilities Catalog (checked, CVE-2026-14191 not listed)
- NVD - CVE-2023-40477 (related RAR3-path predecessor vulnerability)
- ZDI-23-1152 / CVE-2023-40477 disclosure tweet (TheZDIBugs)
- RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability - GitHub Advisory Database (CVE-2023-40477)
- CVE-2023-40477 Root Cause Analysis
Detection coverage for TL-2026-1063
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1063 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.