← Vulnerability feed

Vulnerability record · CVE-2018-25018 · published 1 July 2021

CVE-2018-25018: Rarlab unrar out-of-bounds write vulnerability

Rarlab · Unrar

UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.

7.8 CVSS 3.1 High EPSS 1.3% · top 30.6% CWE-787 · Out-of-bounds write
7.8CVSS 3.1 base score, v2 6.8
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845 ExploitIssue TrackingPatchThird Party Advisory
https://github.com/aawc/unrar/releases Release NotesThird Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845 ExploitIssue TrackingPatchThird Party Advisory
https://github.com/aawc/unrar/releases Release NotesThird Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml Third Party Advisory

Track CVE-2018-25018 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2022-30333UnRAR path traversal allows arbitrary file write on Linux and UNIXRARLAB UnRAR before 6.12 on Linux and UNIX fails to properly sanitize paths during extraction, allowing directory traversal writes outside the intend…KEVEPSS 99%analysed9.8CVE-2017-12940Rarlab unrar out-of-bounds read vulnerabilitylibunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.EPSS 2.2%9.8CVE-2017-12941Rarlab unrar out-of-bounds read vulnerabilitylibunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.EPSS 2.2%9.8CVE-2017-12942Rarlab unrar memory buffer overflow vulnerabilitylibunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.EPSS 2.3%9.8CVE-2012-6706Sophos threat detection engine integer overflow vulnerabilityA VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other pro…EPSS 10%9.1CVE-2017-14122Rarlab unrar out-of-bounds read vulnerabilityunrar 0.0.1 (aka unrar-free or unrar-gpl) suffers from a stack-based buffer over-read in unrarlib.c, related to ExtrFile and stricomp.EPSS 1.8%7.8CVE-2017-20006Rarlab unrar out-of-bounds write vulnerabilityUnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrentFile).EPSS 1.2%7.5CVE-2022-48579Rarlab unrar link following vulnerabilityUnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.EPSS 0.84%

Source: NIST National Vulnerability Database (record CVE-2018-25018), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.