Opening RAR archives in these third-party applications may therefore also fall pray to attacks targeting the vulnerability. If the last update has been released before August 2, 2023, the library files are likely vulnerable.

The latest update date may also provide clues regarding the vulnerability.

While some applications have released updates to resolve the issue, others are still using older versions of the library files, which remain vulnerable.Īdministrators and home users may want to run searches for the two library files on their devices, or check the directories of applications that use the files specifically, to find out if patched versions are installed. The libraries unrar.dll and unrar64.dll, used by third-party applications, are also vulnerable. While it may still make sense to update these to the latest version, the reported security issue can't be exploited in third-party programs that utilize these libraries. Update: we confirmed with WinRAR that the two DLL files are not vulnerable to the security issue. The update to WinRAR 6.23 addresses the vulnerability and WinRAR users should install the update as soon as possible to protect their devices against potential exploits of the vulnerability. The issue, which is identified as CVE-2023-40477, is a high-severity vulnerability found in the processing of recovery volumes. The downloading of such a specially crafted archive and the opening of it on the user's system is sufficient to allow attackers to execute arbitrary code on the device. Users who open specially crafted WinRAR archives on their devices may fall pray to the attack.

Malicious actors can exploit the vulnerability to execute code on devices that run earlier versions of WinRAR.

The release included a security fix that addressed a major out of bounds issue. The developers of WinRAR released version 6.23 of the popular archiving software earlier this month.

WinRAR 6.23 for windows download