CVE-2023-38831

Think of a ZIP file as a backpack that contains items. This bug happens when the backpack contains an innocent-looking file (like a normal .JPG) and also a folder with the same name; when you try to “just view” the picture, WinRAR ends up processing the folder’s contents too, which can include harmful code. So the act of opening/viewing a harmless file becomes the trigger.

This matters to you if you use or run RARLAB WinRAR / rarlab winrar on Windows (versions before 6.23). If your business relies on receiving, downloading, or handling ZIP files—through email, shared drives, vendors, or customer uploads—this is relevant. The problem is not limited to niche enterprise systems; it targets the widely used WinRAR app.

This is RED because it’s actively being exploited in the real world (“itw”), including by ransomware (CISA KEV indicates known exploitation). The risk is especially high because attackers can trigger it through ordinary ZIP files, and a public exploit is available. You should treat this as an urgent patch: update as soon as possible, ideally immediately.

Update/Remediate

• Identify all machines with RARLAB WinRAR / rarlab winrar installed and determine whether they are before 6.23.
• Patch immediately: upgrade WinRAR to 6.23 or later.
• If you manage endpoints, push the update via your usual software deployment method so every user/device is covered (not just the most likely computers).

Triage and verification

• Review recent activity: check for any users who opened or viewed files inside ZIP archives using WinRAR, particularly from email attachments, unknown download links, USB/media, or untrusted vendors.
• If your organization has endpoint detection/response tooling, monitor for signs of process execution soon after WinRAR actions (the key point is that “viewing a benign file” can lead to malicious code execution).

Temporary containment (only if patching is delayed)

• Restrict or discourage using WinRAR to open ZIPs from untrusted sources until updated.
• Consider channeling incoming ZIP handling through safer procedures your IT team recommends (for example, limiting who can open archives and requiring verification before extraction/viewing).

Operational follow-up

• Confirm the updated version is actually installed and in use (users sometimes have multiple versions installed or portable copies).
• Update your internal guidance: “Don’t view ZIP contents with WinRAR unless the source is trusted; update first.”

Severity: HIGH (CVSS 7.8). This vulnerability is listed in CISA KEV as known exploited activity and is reported as exploited in the wild (“itw”).

Affected software: RARLAB WinRAR (WinRAR GmbH WinRAR, rarlab winrar) before 6.23.

Weakness type: A ZIP path/name handling issue where a ZIP can contain both an apparently benign file and a folder sharing the same name; during an attempt to view/access only the benign file, WinRAR processes the folder’s contents.

Attack vector: A crafted ZIP archive delivered to a victim who uses WinRAR on Windows; the victim triggers the bug by attempting to view the benign file inside the archive.

Exploitation status: Public exploit exists; press reports indicate exploitation in the wild from April through October 2023, with rising press attention and an actor name (“Fluffy Wolf”) mentioned in reporting.

EPSS/KEV meaning here: EPSS (97.8% estimated probability in the next 30 days) suggests attackers are highly likely to attempt exploitation soon. CISA KEV (“known exploited in the wild”) indicates this vulnerability has been observed and validated as actively exploited, which is why the remediation urgency is high for real-world use.