CVE-2023-38831
RARLAB WinRAR Code Execution Vulnerability
IN CISA KEV
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
- Vendor
- RARLAB
- Product
- WinRAR
- CVSS 3.1
- 7.8 (high), scored by NVD (primary)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1
- 7.8 (high), scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Published
- 2023-08-23
- NVD modified
- 2026-08-05
- NVD status
- Analyzed
CISA KEV
- Date added
- 2023-08-24
- Due date
- 2023-09-14
- Ransomware use
- Known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS
100% chance of exploitation in the next 30 days (percentile 99th)
FIRST EPSS, updated 17 Oct 2026. About EPSS
CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.
References
- news.ycombinator.com (Issue Tracking)
- news.ycombinator.com (Issue Tracking)
- www.cisa.gov (US Government Resource)
Data last updated 18 Oct 2026. Sources: NVD API 2.0, CISA KEV catalog, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.