{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14191", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "state": "PUBLISHED", "assignerShortName": "securin", "dateReserved": "2026-06-30T08:32:07.249Z", "datePublished": "2026-07-01T02:41:39.316Z", "dateUpdated": "2026-07-01T02:42:05.524Z"}, "containers": {"cna": {"title": "WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader", "descriptions": [{"lang": "en", "value": "An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23."}], "affected": [{"vendor": "RARLAB", "product": "WinRAR", "platforms": ["Windows"], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "7.23", "status": "affected", "versionType": "custom"}]}, {"vendor": "RARLAB", "product": "RAR", "platforms": ["Windows", "Linux", "macOS"], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "7.23", "status": "affected", "versionType": "custom"}]}, {"vendor": "RARLAB", "product": "UnRAR", "platforms": ["Windows", "Linux", "macOS"], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "7.21", "status": "affected", "versionType": "custom"}]}, {"vendor": "RARLAB", "product": "UnRAR.dll", "platforms": ["Windows"], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "7.23", "status": "affected", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-787 Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}, {"lang": "en", "description": "CWE-129 Improper Validation of Array Index", "cweId": "CWE-129", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://www.rarlab.com/download.htm", "name": "WinRAR / RAR 7.23 download (fixed release, 2026-06-30)", "tags": ["patch", "vendor-advisory"]}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40477", "name": "CVE-2023-40477 - Sibling RAR3-path vulnerability fixed in WinRAR 6.23", "tags": ["related"]}], "credits": [{"lang": "en", "value": "Arjun Basnet from Securin", "type": "finder"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "Overflow Buffers - a controlled out-of-bounds heap write with attacker-controlled offset and attacker-influenced value, giving a memory-corruption primitive that can be used to crash the process (verified DoS) and, per the reporter's assessment mirroring the RAR3 sibling CVE-2023-40477, can plausibly be leveraged toward remote code execution in the context of the current user. Code execution was not demonstrated by the reporter."}]}], "timeline": [{"lang": "en", "time": "2026-06-03T02:08:00.000Z", "value": "Vulnerability reported to RARLAB (Eugene Roshal) by Securin"}, {"lang": "en", "time": "2026-06-03T20:01:00.000Z", "value": "RARLAB confirmed the findings after independent source review"}, {"lang": "en", "time": "2026-06-30T07:51:00.000Z", "value": "WinRAR / RAR 7.23 released with .rev processing fix"}, {"lang": "en", "time": "2026-06-30T00:00:00.000Z", "value": "CVE-2026-14191 reserved by Securin CNA"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-07-01T02:42:05.524Z"}}}}

{}

{}

{}

{}