CVE-2023-38831
RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to...
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
- Record
CVE-2023-38831- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-345, CWE-351
- Updated
- 2026-11-02
CVE List
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
- Record
CVE-2023-38831- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-351
- Updated
- 2026-11-02
EUVDEUVD-2023-42604
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
- Record
EUVD-2023-42604- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w5x7-vwr2-4x27
RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to...
RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through August 2023.
- Record
GHSA-w5x7-vwr2-4x27- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-345, CWE-351
- Updated
- 2026-11-02
CISA KEV No score
RARLAB WinRAR Code Execution Vulnerability
RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.
- Record
CVE-2023-38831- Weakness
- CWE-351
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | WinRAR CVE-2023-38831 Exploit | 2023-08-23 |
| PoC in GitHub | BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc | 2023-08-24 |
| PoC in GitHub | b1tg/CVE-2023-38831-winrar-exploit | 2023-08-25 |
| PoC in GitHub | Garck3h/cve-2023-38831 | 2023-08-27 |
| PoC in GitHub | IR-HuntGuardians/CVE-2023-38831-HUNT | 2023-08-27 |
| PoC in GitHub | ignis-sec/CVE-2023-38831-RaRCE | 2023-08-27 |
| PoC in GitHub | HDCE-inc/CVE-2023-38831 | 2023-08-28 |
| PoC in GitHub | Maalfer/CVE-2023-38831_ReverseShell_Winrar-RCE | 2023-08-28 |
| PoC in GitHub | PascalAsch/CVE-2023-38831-KQL | 2023-08-28 |
| PoC in GitHub | ahmed-fa7im/CVE-2023-38831-winrar-expoit-simple-Poc | 2023-08-28 |
Show 16 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | akhomlyuk/cve-2023-38831 | 2023-08-28 |
| PoC in GitHub | knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831 | 2023-08-28 |
| PoC in GitHub | ML-K-eng/CVE-2023-38831-Exploit-and-Detection | 2023-08-29 |
| PoC in GitHub | thegr1ffyn/CVE-2023-38831 | 2023-08-29 |
| PoC in GitHub | Ben1B3astt/CVE-2023-38831_ReverseShell_Winrar | 2023-08-30 |
| PoC in GitHub | MorDavid/CVE-2023-38831-Winrar-Exploit-Generator-POC | 2023-08-30 |
| PoC in GitHub | sh770/CVE-2023-38831 | 2023-08-30 |
| PoC in GitHub | sudo-py-dev/CVE-2023-38831 | 2023-08-30 |
| PoC in GitHub | z3r0sw0rd/CVE-2023-38831-PoC | 2023-08-30 |
| PoC in GitHub | Mich-ele/CVE-2023-38831-winrar | 2023-09-01 |
| PoC in GitHub | Fa1c0n35/CVE-2023-38831-winrar-exploit | 2023-09-03 |
| PoC in GitHub | asepsaepdin/CVE-2023-38831 | 2023-09-03 |
| PoC in GitHub | xaitax/WinRAR-CVE-2023-38831 | 2023-09-03 |
| PoC in GitHub | GOTonyGO/CVE-2023-38831-winrar | 2023-09-07 |
| PoC in GitHub | Malwareman007/CVE-2023-38831 | 2023-09-12 |
| PoC in GitHub | ameerpornillos/CVE-2023-38831-WinRAR-Exploit | 2023-09-12 |
Plus 35 more. The full list has every link.
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits_more | PoC in GitHub | |
| exploits_more | PoC in GitHub | |
| exploitation | ||
| exploits, exploits_more | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38831 is a high vulnerability (CVSS 7.8) in Rarlab Winrar, published August 23, 2023. CISA lists it as known to be exploited, since August 24, 2023. EUVD reports exploitation since August 24, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.8%, the 99th percentile. No source names a fixed version.
References
group-ib.com/blog/cve-2023-38831-winrar-zero-day
bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts
news.ycombinator.com/item?id=37236100
packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html
blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831
nvd.nist.gov/vuln/detail/CVE-2023-38831
github.com/advisories/GHSA-w5x7-vwr2-4x27