Description
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| RARLAB | WinRAR | 6.21 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libclamunrar | 1.0.3-1 | — |
| Debian 14 | rar | 2:6.23-1 | — |
| Debian 14 | unrar-nonfree | 1:6.2.10-1 | — |
| Debian 13 | libclamunrar | 1.0.3-1 | — |
| Debian 13 | rar | 2:6.23-1 | — |
| Debian 13 | unrar-nonfree | 1:6.2.10-1 | — |
| Debian 12 | libclamunrar | 1.0.3-1~deb12u1 | — |
| Debian 12 | rar | 2:6.23-1~deb12u1 | — |
| Debian 12 | unrar-nonfree | 1:6.2.6-1+deb12u1 | — |
| Debian 10 | libclamunrar | 0.103.10-0+deb10u1 | DLA-3653-1 |
| Debian 10 | rar | 2:6.23-1~deb10u1 | DLA-3543-1 |
| Debian 10 | unrar-nonfree | 1:5.6.6-1+deb10u4 | DLA-3542-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | rar | 2:6.23-1 | — |
| Ubuntu 22.04 LTS | libclamunrar | 0.103.11-0ubuntu0.22.04.1 | USN-6569-1 |
| Ubuntu 22.04 LTS | rar | 2:6.23-1~22.04.1 | USN-7349-1 |
| Ubuntu 22.04 LTS | unrar-nonfree | 1:6.1.5-1ubuntu0.1 | USN-7350-1 |
| Ubuntu 20.04 LTS | libclamunrar | 0.103.11-0ubuntu0.20.04.1 | USN-6569-1 |
| Ubuntu 20.04 LTS | rar | 2:6.23-1~20.04.1 | USN-7349-1 |
| Ubuntu 20.04 LTS | unrar-nonfree | 1:5.6.6-2ubuntu0.1 | USN-7350-1 |
| Ubuntu 18.04 LTS | rar +2 | No fix yet | — |
| Ubuntu 16.04 LTS | rar +2 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLES 15 SP4 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLES 15 SP3 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLES 15 SP2 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLES 15 SP1 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | clamav | 0.103.11-3.30.1 | SUSE-SU-2023:4297-1 |
| SLES for SAP 15 SP3 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLES for SAP 15 SP2 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLES for SAP 15 SP1 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLES for SAP 12 SP5 | clamav | 0.103.11-3.30.1 | SUSE-SU-2023:4297-1 |
| SLE HPC 15 SP3 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLE HPC 15 SP2 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SLE HPC 15 SP1 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SUSE Manager Server 4.2 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SUSE Manager Proxy 4.2 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| SUSE Enterprise Storage 7.1 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | clamav | 0.103.11-2.1 | openSUSE-SU-2024:13394-1 |
| openSUSE Leap 15.5 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
| openSUSE Leap 15.4 | clamav | 0.103.11-150000.3.50.1 | SUSE-SU-2023:4415-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
wildptr-io/Winrar-CVE-2023-40477-POC ★ 27 · Aug 29, 2023
CVE-2023-40477 PoC by Wild-Pointer
-
winkler-winsen/Scan_WinRAR ★ 0 · Aug 29, 2023
Scan for WinRAR files affected to CVE-2023-40477
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 11
- USN-7350-1 unrar-nonfree vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-7349-1 rar vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-6569-1 libclamunrar vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- DLA-3653-1 libclamunrar - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3542-1 unrar-nonfree - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3543-1 rar - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:4297-1 Security update for clamav SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4415-1 Security update for clamav SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13394-1 clamav-0.103.11-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-2093 win.rar WinRAR: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Mar 12, 2025
References
- ZDI-23-1152
- vendor-provided URL vendor-advisory