CVE-2018-20252

In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@checkpoint.com

Published

2019-02-05

Last modified

2024-09-16

Weaknesses

CWE-787

Affected products

• Winrar (Check Point Software Technologies Ltd.)
• Winrar (Rarlab)

References

• http://www.securityfocus.com/bid/106948
• https://research.checkpoint.com/extracting-code-execution-from-winrar/
• https://www.win-rar.com/whatsnew.html