# WinRAR 7.23 Fixes Heap Overflow in RAR5 Recovery Volume Processing (CVE-2026-14191)

> WinRAR, RAR, and UnRAR before 7.23 contain a heap out-of-bounds write (CWE-787/CWE-129) in the RAR5 recovery-volume (.rev) parser, reachable when a victim runs a recovery, test, or auto-repair operation on an attacker-crafted .rev set. No public PoC or in-the-wild exploitation has been observed; RARLAB shipped a fix in version 7.23.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1063
- **ID:** TL-2026-1063
- **Severity:** MEDIUM (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-14191, CVE-2023-40477

## Description

CVE-2026-14191 is an out-of-bounds heap write vulnerability discovered by Arjun Basnet of Securin Labs (with additional credit to researcher 'scofaild23-bnomran') in the RAR5 recovery-volume reconstruction logic implemented in RecVolumes5::ReadHeader (recvol5.cpp). The RecItems vector that tracks recovery-volume metadata is sized only once, when the first .rev file in a multi-volume recovery set is parsed. Every subsequent .rev file in the set supplies its own independent RecNum index value, and that value is validated only against the current file's own TotalCount field -- never against the actual allocated size of the RecItems vector established from the first file. By crafting a second (or later) .rev file with a RecNum far larger than the original allocation, an attacker can force the parser to write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum], an out-of-bounds offset that can reach up to 65534 * sizeof(RecVolItem) bytes past the end of the allocation. This corrupts adjacent heap objects and, depending on heap layout, allocator behavior, and platform mitigations (ASLR/DEP/heap hardening), can be leveraged for denial of service or, in a worst case, arbitrary code execution.

Exploitation is not automatic on file receipt: the vulnerable code path only runs when the victim explicitly triggers a recovery/repair/test action against a malicious .rev volume set, for example `unrar t x.part1.rev`, WinRAR's 'Repair archive' function, or WinRAR's automatic archive-recovery prompt that appears when extracting a RAR volume set with a missing .rar part. This makes social engineering (bundling a poisoned .rev set with an otherwise-legitimate multi-volume archive and prompting the user to repair/test it) the primary realistic delivery path, and it is a particular concern for unattended automation -- mail gateways, backup/archival pipelines, and file-processing services that auto-verify or auto-repair inbound archives.

The flaw is the RAR5-format sibling of CVE-2023-40477 (ZDI-23-1152, CWE-129), a near-identical out-of-bounds recovery-volume index validation bug that was previously fixed only in the legacy RAR3 recovery-volume code path in WinRAR 6.23 (August 2023). CVE-2026-14191 shows that the equivalent RAR5-path logic was left unpatched for roughly three years until RARLAB's July 2026 release. NVD lists WinRAR (Windows) < 7.23, RAR (Windows/Linux/macOS) < 7.23, UnRAR (Windows/Linux/macOS) <= 7.21, and UnRAR.dll (Windows) < 7.23 as affected products; RARLAB's own release notes state UnRAR.dll is not affected because it does not implement recovery-volume processing at all -- a discrepancy between the NVD product list and the vendor's own scoping that defenders relying on UnRAR.dll-only integrations should independently verify.

WinRAR 7.23 also shipped two unrelated hardening fixes in the same release: a further check preventing symbolic-link-based path traversal outside the extraction destination (closing a residual bypass even across multiple extraction commands), and an update of the bundled 7zxa.dll (7-Zip decoder) component to upstream version 26.02 to pick up unspecified 7-Zip bug and vulnerability fixes.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1204.002 Malicious File
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1068 Exploitation for Privilege Escalation
- T1499 Endpoint Denial of Service
- T1518 Software Discovery
- T1587 Develop Capabilities
- T1587.001 Malware
- T1588.006 Vulnerabilities
- T1608.001 Upload Malware
- T1592.002 Software
- T1036.008 Masquerade File Type

## Sources

- [WinRAR 7.23 Fixes Heap Overflow Vulnerability](https://cybersecuritynews.com/winrar-7-23-fixes-heap-overflow-vulnerability/)
- [CVE-2026-14191: CWE-787 Out-of-bounds Write in RARLAB WinRAR - Threat Radar](https://radar.offseq.com/threat/cve-2026-14191-cwe-787-out-of-bounds-write-in-rarl-dea7227c2d7fb8ff)
- [WinRAR What's New / Changelog (7.23)](https://www.win-rar.com/whatsnew.html?L=0)
- [RARLAB WinRAR/RAR download page](https://www.rarlab.com/download.htm)
- [NVD - CVE-2026-14191](https://nvd.nist.gov/vuln/detail/CVE-2026-14191)
- [CISA Known Exploited Vulnerabilities Catalog (checked, CVE-2026-14191 not listed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD - CVE-2023-40477 (related RAR3-path predecessor vulnerability)](https://nvd.nist.gov/vuln/detail/cve-2023-40477)
- [ZDI-23-1152 / CVE-2023-40477 disclosure tweet (TheZDIBugs)](https://x.com/TheZDIBugs/status/1692635574338019724)
- [RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability - GitHub Advisory Database (CVE-2023-40477)](https://github.com/advisories/GHSA-58vr-f4x9-3h36)
- [CVE-2023-40477 Root Cause Analysis](https://www.richardosgood.com/posts/cve-2023-4047-root-cause-analysis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1063