Skip to content
Fencer Vulns
high 7.8

CVE-2023-40477 in the critical feed json

RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability

published 2024-05-03 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-45048

cvss
7.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
11.4%
EPSS 11.4% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.

Patch / fix

  • rarlab winrar 6.23
  • rar Debian 12 2:6.23-1~deb12u1
  • rar Debian 14, Debian 13 2:6.23-1
  • libclamunrar Debian 12 1.0.3-1~deb12u1
  • libclamunrar Debian 14, Debian 13 1.0.3-1
  • unrar-nonfree Debian 12 1:6.2.6-1+deb12u1
  • unrar-nonfree Debian 14, Debian 13 1:6.2.10-1

debian advisories DEBIAN-CVE-2023-40477

  • rar Ubuntu 20.04 LTS 2:6.23-1~20.04.1
  • rar Ubuntu 22.04 LTS 2:6.23-1~22.04.1
  • rar Ubuntu 24.04 LTS 2:6.23-1
  • libclamunrar Ubuntu 20.04 LTS 0.103.11-0ubuntu0.20.04.1
  • libclamunrar Ubuntu 22.04 LTS 0.103.11-0ubuntu0.22.04.1
  • unrar-nonfree Ubuntu 20.04 LTS 1:5.6.6-2ubuntu0.1
  • unrar-nonfree Ubuntu 22.04 LTS 1:6.1.5-1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2023-40477

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • clamav SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +14 more 0.103.11-150000.3.50.1
  • clamav SLES for SAP 12 SP5, SLES 12 SP5 0.103.11-3.30.1

suse advisories SUSE-SU-2023:4415-1SUSE-SU-2023:4297-1

  • clamav openSUSE Tumbleweed 0.103.11-2.1

opensuse advisories openSUSE-SU-2024:13394-1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

11.38% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • RARLAB WinRAR

Classification

Weakness
  • CWE-129 Improper Validation of Array Index

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.