← Vulnerability feed

Vulnerability record · CVE-2022-43650 · published 29 March 2023

CVE-2022-43650: Rarlab winrar out-of-bounds read vulnerability

Rarlab · Winrar

This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. Crafted data in a ZIP file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-19232.

7.1 CVSS 3.1 High EPSS 23% · top 2.3% CWE-125 · Out-of-bounds read
7.1CVSS 3.1 base score
23%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. Crafted data in a ZIP file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-19232.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=216&cHash=983dfbcc83fb1b64a5f792891a281709 Release Notes
https://www.zerodayinitiative.com/advisories/ZDI-23-092/ Third Party AdvisoryVDB Entry
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=216&cHash=983dfbcc83fb1b64a5f792891a281709 Release Notes
https://www.zerodayinitiative.com/advisories/ZDI-23-092/ Third Party AdvisoryVDB Entry

Track CVE-2022-43650 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.4CVE-2025-8088WinRAR path traversal lets crafted archives execute codeCVE-2025-8088 is a path traversal flaw in the Windows version of WinRAR that allows attackers to execute arbitrary code by crafting malicious archive…KEVEPSS 94%analysed7.8CVE-2025-6218WinRAR path traversal in archive file handling leads to code executionWinRAR mishandles file paths inside archive files, allowing a crafted path to traverse out of the intended extraction directory (CWE-22). Because the…KEVEPSS 90%analysed7.8CVE-2023-38831WinRAR ZIP archive spoofing leads to arbitrary code executionWinRAR before 6.23 mishandles ZIP archives that contain a benign file and a folder with the same name, causing the folder's contents to be processed …KEVEPSS 100%analysed7.8CVE-2018-20250WinRAR ACE filename path traversal enables arbitrary file writeWinRAR versions up to and including 5.61 mishandle the filename field in ACE archives processed by UNACEV2.dll, allowing a crafted filename to be tre…KEVEPSS 96%analysed10.0CVE-2008-7144Rarlab winrar vulnerabilityMultiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to crafted (1) ACE, (2) ARJ, (3) BZ2…EPSS 2.3%10.0CVE-2004-1254Rarlab winrar vulnerabilityWinRAR 3.40, and possibly earlier versions, allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, …EPSS 10%10.0CVE-2004-0234Clearswift mailsweeper memory buffer overflow vulnerabilityMultiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow…EPSS 10%9.3CVE-2006-3845Rarlab winrar vulnerabilityStack-based buffer overflow in lzh.fmt in WinRAR 3.00 through 3.60 beta 6 allows remote attackers to execute arbitrary code via a long filename in a …EPSS 7.9%

Source: NIST National Vulnerability Database (record CVE-2022-43650), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.