CVE-2019-25677: rarlab winrar

Vulnerability summary

CVE-2019-25677 is a medium (CVSS 6.9) vulnerability in rarlab winrar. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-04-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.

• CWE-379Creation of Temporary File in Directory with Insecure PermissionsThe product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.