Vulnerability record · CVE-2008-7144 · published 1 September 2009

CVE-2008-7144: Rarlab winrar vulnerability

Rarlab · Winrar

Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to crafted (1) ACE, (2) ARJ, (3) BZ2, (4) CAB, (5) GZ, (6) LHA, (7) RAR, (8) TAR, or (9) ZIP files, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats.

10.0 CVSS 2.0 High EPSS 2.3% · top 17.7%

10.0CVSS 2.0 base score

2.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Winrar Rarlab

References

Link	Tags
http://osvdb.org/43439
http://secunia.com/advisories/29407	Vendor Advisory
http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html
http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/
http://www.vupen.com/english/advisories/2008/0916/references	PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41251
http://osvdb.org/43439
http://secunia.com/advisories/29407	Vendor Advisory
http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html
http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/
http://www.vupen.com/english/advisories/2008/0916/references	PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41251

Track CVE-2008-7144 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.4CVE-2025-8088WinRAR path traversal lets crafted archives execute codeCVE-2025-8088 is a path traversal flaw in the Windows version of WinRAR that allows attackers to execute arbitrary code by crafting malicious archive…KEVEPSS 94%analysed8 Aug 2025 7.8CVE-2025-6218WinRAR path traversal in archive file handling leads to code executionWinRAR mishandles file paths inside archive files, allowing a crafted path to traverse out of the intended extraction directory (CWE-22). Because the…KEVEPSS 90%analysed21 Jun 2025 7.8CVE-2023-38831WinRAR ZIP archive spoofing leads to arbitrary code executionWinRAR before 6.23 mishandles ZIP archives that contain a benign file and a folder with the same name, causing the folder's contents to be processed …KEVEPSS 100%analysed23 Aug 2023 7.8CVE-2018-20250WinRAR ACE filename path traversal enables arbitrary file writeWinRAR versions up to and including 5.61 mishandle the filename field in ACE archives processed by UNACEV2.dll, allowing a crafted filename to be tre…KEVEPSS 96%analysed5 Feb 2019 10.0CVE-2004-1254Rarlab winrar vulnerabilityWinRAR 3.40, and possibly earlier versions, allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, …EPSS 10%10 Jan 2005 10.0CVE-2004-0234Clearswift mailsweeper memory buffer overflow vulnerabilityMultiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow…EPSS 10%18 Aug 2004 9.3CVE-2006-3845Rarlab winrar vulnerabilityStack-based buffer overflow in lzh.fmt in WinRAR 3.00 through 3.60 beta 6 allows remote attackers to execute arbitrary code via a long filename in a …EPSS 7.9%25 Jul 2006 7.8CVE-2023-40477Rarlab winrar vulnerabilityRARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e…EPSS 11%3 May 2024

Source: NIST National Vulnerability Database (record CVE-2008-7144), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.