CVE-2012-1443: RAR parser malware detection bypass in multiple antivirus engines

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

medium priorityThe flaw only bypasses detection rather than granting code execution, and CVSS is 4.3, but the very high EPSS and broad product exposure keep it relevant for defenders.

What it is

The RAR file parser in dozens of antivirus products fails to correctly handle a RAR archive whose contents begin with an MZ character sequence, allowing the archive to evade malware detection. Because the same parsing flaw appears across many independent engines, a single crafted archive can slip past layered defenses. The record notes it may later be split into multiple CVEs if the error is shown to occur independently per implementation.

Impact

An attacker can deliver a malicious RAR archive that the affected scanner does not flag, so malware reaches the endpoint or gateway undetected. The attacker gains no code execution from the flaw itself; the gain is evasion of the detection control.

Attack surface

Reached remotely by sending a crafted RAR file to a scanning engine, whether at a mail or web gateway or on an endpoint. No authentication is required, but the victim must be induced to open or scan the file, so exploitation is user-assisted.

Exploitation

Not listed in CISA KEV and no reference is tagged as exploit code, but EPSS is very high (0.99636, 99.9th percentile), indicating strong predicted likelihood of exploitation activity. No public exploit details are provided in the record.

What to do

• Apply vendor updates for each affected antivirus engine; this is a 2012 flaw, so confirm current versions are in use and no longer affected.
• Do not rely on a single scanning engine for RAR content; add a second engine or a dedicated file-type and content inspection layer.
• Block or quarantine inbound RAR archives at mail and web gateways unless there is a clear business need.
• Inspect archive contents after extraction rather than trusting the scanner's verdict on the container.
• Retire or isolate end-of-life engines listed in the record that no longer receive signature or parser fixes.

Detection

• Alert on RAR archives whose extracted content begins with the MZ header, especially when the archive was not flagged by the scanner.
• Monitor for files that pass antivirus scanning but later execute or drop PE payloads from archive extraction paths.
• Track scanner verdicts for RAR attachments and flag archives that produce no detection but contain executable content.
• Review gateway and endpoint logs for repeated delivery of RAR files from the same sender or source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.