CVE-2024-33899
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen...
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- Record
CVE-2024-33899- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-150
- Updated
- 2026-11-02
EUVDEUVD-2024-31603
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- Record
EUVD-2024-31603- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7m59-rfr2-gh4p
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen...
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- Record
GHSA-7m59-rfr2-gh4p- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-150
- Updated
- 2026-11-02
NVD
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- Record
CVE-2024-33899- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-150
- Updated
- 2026-11-02
OSV
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- Record
CVE-2024-33899- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-33899
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- Record
DEBIAN-CVE-2024-33899- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-33899
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- Record
UBUNTU-CVE-2024-33899- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2024:1975-1 No score
Security update for unrar
This update for unrar fixes the following issues:
- CVE-2024-33899: Fixed a denial of service via ANSI escape squences. (bsc#1225661)
- Record
SUSE-SU-2024:1975-1- Updated
- 2026-11-02
OSVUSN-7350-1 No score
unrar-nonfree vulnerabilities
It was discovered that UnRAR incorrectly handled certain paths. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to write arbitrary files outside of the targeted directory. (CVE-2022-30333, CVE-2022-48579)
It was discovered that UnRAR incorrectly handled certain recovery volumes. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2023-40477)
Siddharth Dushantha discovered that UnRAR incorrectly handled ANSI escape sequences when writing screen output. If a user or automated system were tricked into processing a specially crafted RAR archive, a remote attacker could possibly use this issue to spoof screen output or cause a denial of service. (CVE-2024-33899)
- Record
USN-7350-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rarDebian:12 |
before 2:7.01-1~deb12u1, plus listed versions 1:3.5.1-11:3.6.0-11:3.7.1-11:3.7.1-21:3.7b1-1 Show 36 moreShow less1:3.7b1-21:3.8.0-11:3.8.0-21:3.8b2-11:3.8b2-21:3.8b3-11:3.9.b2-11:3.9.b3-12.02-22.60-12.80-22:3.9.0-12:3.9.1-12:3.9.2-12:3.9.3-12:4.0.b2-12:4.0.b3-12:4.2.0+dfsg.1-0.12:4.2.0-12:5.2.1b2-12:5.3.b2-12:5.4.0+dfsg.1-0.12:5.4.0-12:5.5.0-12:5.5.0-1.12:6.11-0.12:6.20-0.12:6.20-0.1~deb10u12:6.20-0.1~deb11u12:6.20~b1-0.12:6.23-12:6.23-1~deb10u12:6.23-1~deb11u12:6.23-1~deb12u12:7.00-13.30-2 |
2:7.01-1~deb12u1 |
rarDebian:13 |
before 2:7.00-1, plus listed versions 1:3.5.1-11:3.6.0-11:3.7.1-11:3.7.1-21:3.7b1-1 Show 35 moreShow less1:3.7b1-21:3.8.0-11:3.8.0-21:3.8b2-11:3.8b2-21:3.8b3-11:3.9.b2-11:3.9.b3-12.02-22.60-12.80-22:3.9.0-12:3.9.1-12:3.9.2-12:3.9.3-12:4.0.b2-12:4.0.b3-12:4.2.0+dfsg.1-0.12:4.2.0-12:5.2.1b2-12:5.3.b2-12:5.4.0+dfsg.1-0.12:5.4.0-12:5.5.0-12:5.5.0-1.12:6.11-0.12:6.20-0.12:6.20-0.1~deb10u12:6.20-0.1~deb11u12:6.20~b1-0.12:6.23-12:6.23-1~deb10u12:6.23-1~deb11u12:6.23-1~deb12u13.30-2 |
2:7.00-1 |
rarDebian:14 |
before 2:7.00-1, plus listed versions 1:3.5.1-11:3.6.0-11:3.7.1-11:3.7.1-21:3.7b1-1 Show 35 moreShow less1:3.7b1-21:3.8.0-11:3.8.0-21:3.8b2-11:3.8b2-21:3.8b3-11:3.9.b2-11:3.9.b3-12.02-22.60-12.80-22:3.9.0-12:3.9.1-12:3.9.2-12:3.9.3-12:4.0.b2-12:4.0.b3-12:4.2.0+dfsg.1-0.12:4.2.0-12:5.2.1b2-12:5.3.b2-12:5.4.0+dfsg.1-0.12:5.4.0-12:5.5.0-12:5.5.0-1.12:6.11-0.12:6.20-0.12:6.20-0.1~deb10u12:6.20-0.1~deb11u12:6.20~b1-0.12:6.23-12:6.23-1~deb10u12:6.23-1~deb11u12:6.23-1~deb12u13.30-2 |
2:7.00-1 |
unrar-nonfreeDebian:12 |
All versions, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 45 moreShow less1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2 |
None known |
unrar-nonfreeDebian:13 |
before 1:7.0.3-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 45 moreShow less1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2 |
1:7.0.3-1 |
unrar-nonfreeDebian:14 |
before 1:7.0.3-1, plus listed versions 1:3.5.2-0.11:3.5.2-0.21:3.5.4-0.11:3.5.4-11:3.5.4-1.1 Show 45 moreShow less1:3.7.2-11:3.7.3-11:3.7.3-1.11:3.7.8-11:3.7.8-21:3.8.2-11:3.8.4-11:3.8.5-11:3.8.5-21:3.9.10-11:3.9.3-11:3.9.5-11:3.9.6-11:3.9.7-11:3.9.9-11:4.0.2-11:4.0.3-11:4.1.4-11:4.2.4-0.11:4.2.4-0.21:4.2.4-0.31:5.0.10-11:5.2.5-11:5.2.7-0.11:5.3.2-11:5.4.5-11:5.5.5-11:5.5.8-11:5.6.6-11:5.6.6-21:5.9.4-11:6.0.3-11:6.0.4-11:6.0.4-21:6.0.5-11:6.0.6-11:6.0.7-11:6.0.7-21:6.0.7-31:6.0.7-41:6.0.7-51:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-2 |
1:7.0.3-1 |
unrarSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 5.6.1-4.11.1 | 5.6.1-4.11.1 |
unrarSUSE:Linux Enterprise Server 12 SP5 |
before 5.6.1-4.11.1 | 5.6.1-4.11.1 |
unrarSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 5.6.1-4.11.1 | 5.6.1-4.11.1 |
unrar-nonfreeUbuntu:16.04:LTS |
All versions, plus listed versions 1:5.3.2-11:5.3.2-1+deb9u1build0.16.04.1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
unrar-nonfreeUbuntu:18.04:LTS |
All versions, plus listed versions 1:5.5.8-1 |
None known |
unrar-nonfreeUbuntu:20.04:LTS |
before 1:5.6.6-2ubuntu0.1, plus listed versions 1:5.6.6-21:5.6.6-2build1 |
1:5.6.6-2ubuntu0.1 |
unrar-nonfreeUbuntu:22.04:LTS |
before 1:6.1.5-1ubuntu0.1, plus listed versions 1:6.0.5-11:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-21:6.1.4-11:6.1.5-1 |
1:6.1.5-1ubuntu0.1 |
unrar-nonfreeUbuntu:20.04:LTS From an advisory covering 4 CVEs |
before 1:5.6.6-2ubuntu0.1, plus listed versions 1:5.6.6-21:5.6.6-2build1 |
1:5.6.6-2ubuntu0.1 |
unrar-nonfreeUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 1:6.1.5-1ubuntu0.1, plus listed versions 1:6.0.5-11:6.0.7-61:6.1.2-11:6.1.3-11:6.1.3-21:6.1.4-11:6.1.5-1 |
1:6.1.5-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-33899 is a high vulnerability (CVSS 7.1) in Rarlab Winrar, published April 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in rar 2:7.01-1~deb12u1.
References
Left out here: 129 versions. The JSON record has them.