{"id":"CVE-2024-33899","aliases":["DEBIAN-CVE-2024-33899","EUVD-2024-31603","GHSA-7m59-rfr2-gh4p","SUSE-SU-2024:1975-1","UBUNTU-CVE-2024-33899","USN-7350-1"],"status":"published","title":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen...","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00817,"percentile":0.57457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-150"],"published":"2024-04-28T00:00:00Z","modified":"2026-11-02T12:02:22Z","fixes":[{"ecosystem":"Debian:12","package":"rar","fixed_in":["2:7.01-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rar","fixed_in":["2:7.00-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rar","fixed_in":["2:7.00-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"unrar-nonfree","fixed_in":["1:7.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"unrar-nonfree","fixed_in":["1:7.0.3-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"unrar","fixed_in":["5.6.1-4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"unrar","fixed_in":["5.6.1-4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"unrar","fixed_in":["5.6.1-4.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"unrar-nonfree","fixed_in":["1:5.6.6-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"unrar-nonfree","fixed_in":["1:6.1.5-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.01-1~deb12u1"}]}],"versions":["1:3.5.1-1","1:3.6.0-1","1:3.7.1-1","1:3.7.1-2","1:3.7b1-1","1:3.7b1-2","1:3.8.0-1","1:3.8.0-2","1:3.8b2-1","1:3.8b2-2","1:3.8b3-1","1:3.9.b2-1","1:3.9.b3-1","2.02-2","2.60-1","2.80-2","2:3.9.0-1","2:3.9.1-1","2:3.9.2-1","2:3.9.3-1","2:4.0.b2-1","2:4.0.b3-1","2:4.2.0+dfsg.1-0.1","2:4.2.0-1","2:5.2.1b2-1","2:5.3.b2-1","2:5.4.0+dfsg.1-0.1","2:5.4.0-1","2:5.5.0-1","2:5.5.0-1.1","2:6.11-0.1","2:6.20-0.1","2:6.20-0.1~deb10u1","2:6.20-0.1~deb11u1","2:6.20~b1-0.1","2:6.23-1","2:6.23-1~deb10u1","2:6.23-1~deb11u1","2:6.23-1~deb12u1","2:7.00-1","3.30-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.00-1"}]}],"versions":["1:3.5.1-1","1:3.6.0-1","1:3.7.1-1","1:3.7.1-2","1:3.7b1-1","1:3.7b1-2","1:3.8.0-1","1:3.8.0-2","1:3.8b2-1","1:3.8b2-2","1:3.8b3-1","1:3.9.b2-1","1:3.9.b3-1","2.02-2","2.60-1","2.80-2","2:3.9.0-1","2:3.9.1-1","2:3.9.2-1","2:3.9.3-1","2:4.0.b2-1","2:4.0.b3-1","2:4.2.0+dfsg.1-0.1","2:4.2.0-1","2:5.2.1b2-1","2:5.3.b2-1","2:5.4.0+dfsg.1-0.1","2:5.4.0-1","2:5.5.0-1","2:5.5.0-1.1","2:6.11-0.1","2:6.20-0.1","2:6.20-0.1~deb10u1","2:6.20-0.1~deb11u1","2:6.20~b1-0.1","2:6.23-1","2:6.23-1~deb10u1","2:6.23-1~deb11u1","2:6.23-1~deb12u1","3.30-2"]},{"source":"osv","ecosystem":"Debian:14","package":"rar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.00-1"}]}],"versions":["1:3.5.1-1","1:3.6.0-1","1:3.7.1-1","1:3.7.1-2","1:3.7b1-1","1:3.7b1-2","1:3.8.0-1","1:3.8.0-2","1:3.8b2-1","1:3.8b2-2","1:3.8b3-1","1:3.9.b2-1","1:3.9.b3-1","2.02-2","2.60-1","2.80-2","2:3.9.0-1","2:3.9.1-1","2:3.9.2-1","2:3.9.3-1","2:4.0.b2-1","2:4.0.b3-1","2:4.2.0+dfsg.1-0.1","2:4.2.0-1","2:5.2.1b2-1","2:5.3.b2-1","2:5.4.0+dfsg.1-0.1","2:5.4.0-1","2:5.5.0-1","2:5.5.0-1.1","2:6.11-0.1","2:6.20-0.1","2:6.20-0.1~deb10u1","2:6.20-0.1~deb11u1","2:6.20~b1-0.1","2:6.23-1","2:6.23-1~deb10u1","2:6.23-1~deb11u1","2:6.23-1~deb12u1","3.30-2"]},{"source":"osv","ecosystem":"Debian:12","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.5.2-0.1","1:3.5.2-0.2","1:3.5.4-0.1","1:3.5.4-1","1:3.5.4-1.1","1:3.7.2-1","1:3.7.3-1","1:3.7.3-1.1","1:3.7.8-1","1:3.7.8-2","1:3.8.2-1","1:3.8.4-1","1:3.8.5-1","1:3.8.5-2","1:3.9.10-1","1:3.9.3-1","1:3.9.5-1","1:3.9.6-1","1:3.9.7-1","1:3.9.9-1","1:4.0.2-1","1:4.0.3-1","1:4.1.4-1","1:4.2.4-0.1","1:4.2.4-0.2","1:4.2.4-0.3","1:5.0.10-1","1:5.2.5-1","1:5.2.7-0.1","1:5.3.2-1","1:5.4.5-1","1:5.5.5-1","1:5.5.8-1","1:5.6.6-1","1:5.6.6-2","1:5.9.4-1","1:6.0.3-1","1:6.0.4-1","1:6.0.4-2","1:6.0.5-1","1:6.0.6-1","1:6.0.7-1","1:6.0.7-2","1:6.0.7-3","1:6.0.7-4","1:6.0.7-5","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1","1:6.1.6-1","1:6.1.6-2","1:6.1.6-3","1:6.1.7-1","1:6.1.7-2","1:6.1.7-3","1:6.1.7-4","1:6.2.1-1","1:6.2.1-2","1:6.2.10-1","1:6.2.10-2","1:6.2.11-1","1:6.2.12-1","1:6.2.2-1","1:6.2.2-2","1:6.2.3-1","1:6.2.3-2","1:6.2.5-1","1:6.2.6-1","1:6.2.6-1+deb12u1","1:6.2.7-1","1:6.2.8-1","1:6.2.9-1","1:7.0.1-1","1:7.0.1-2","1:7.0.2-1","1:7.0.3-1","1:7.0.4-1","1:7.0.5-1","1:7.0.6-1","1:7.0.6-1.1","1:7.0.6-1.1~exp1","1:7.0.7-1","1:7.0.8-1","1:7.0.9-1","1:7.1.1-1","1:7.1.10-1","1:7.1.10-2","1:7.1.10-3","1:7.1.2-1","1:7.1.2-2","1:7.1.2-3","1:7.1.3-1","1:7.1.4-1","1:7.1.4-2","1:7.1.5-1","1:7.1.5-2","1:7.1.5-3","1:7.1.6-1","1:7.1.7-1","1:7.1.8-1","1:7.1.9-1","1:7.2.1-1","1:7.2.2-1","1:7.2.3-1","1:7.2.3-2","1:7.2.4-1","1:7.2.5-1","1:7.2.5-2","1:7.2.6-1","1:7.2.7-1","1:7.2.7-2","1:7.3.1-1","1:7.3.2-1","3.3.6-2","3.3.6-2.0.1","3.4.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.3-1"}]}],"versions":["1:3.5.2-0.1","1:3.5.2-0.2","1:3.5.4-0.1","1:3.5.4-1","1:3.5.4-1.1","1:3.7.2-1","1:3.7.3-1","1:3.7.3-1.1","1:3.7.8-1","1:3.7.8-2","1:3.8.2-1","1:3.8.4-1","1:3.8.5-1","1:3.8.5-2","1:3.9.10-1","1:3.9.3-1","1:3.9.5-1","1:3.9.6-1","1:3.9.7-1","1:3.9.9-1","1:4.0.2-1","1:4.0.3-1","1:4.1.4-1","1:4.2.4-0.1","1:4.2.4-0.2","1:4.2.4-0.3","1:5.0.10-1","1:5.2.5-1","1:5.2.7-0.1","1:5.3.2-1","1:5.4.5-1","1:5.5.5-1","1:5.5.8-1","1:5.6.6-1","1:5.6.6-2","1:5.9.4-1","1:6.0.3-1","1:6.0.4-1","1:6.0.4-2","1:6.0.5-1","1:6.0.6-1","1:6.0.7-1","1:6.0.7-2","1:6.0.7-3","1:6.0.7-4","1:6.0.7-5","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1","1:6.1.6-1","1:6.1.6-2","1:6.1.6-3","1:6.1.7-1","1:6.1.7-2","1:6.1.7-3","1:6.1.7-4","1:6.2.1-1","1:6.2.1-2","1:6.2.10-1","1:6.2.10-2","1:6.2.11-1","1:6.2.12-1","1:6.2.2-1","1:6.2.2-2","1:6.2.3-1","1:6.2.3-2","1:6.2.5-1","1:6.2.6-1","1:6.2.7-1","1:6.2.8-1","1:6.2.9-1","1:7.0.1-1","1:7.0.1-2","1:7.0.2-1","3.3.6-2","3.3.6-2.0.1","3.4.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.3-1"}]}],"versions":["1:3.5.2-0.1","1:3.5.2-0.2","1:3.5.4-0.1","1:3.5.4-1","1:3.5.4-1.1","1:3.7.2-1","1:3.7.3-1","1:3.7.3-1.1","1:3.7.8-1","1:3.7.8-2","1:3.8.2-1","1:3.8.4-1","1:3.8.5-1","1:3.8.5-2","1:3.9.10-1","1:3.9.3-1","1:3.9.5-1","1:3.9.6-1","1:3.9.7-1","1:3.9.9-1","1:4.0.2-1","1:4.0.3-1","1:4.1.4-1","1:4.2.4-0.1","1:4.2.4-0.2","1:4.2.4-0.3","1:5.0.10-1","1:5.2.5-1","1:5.2.7-0.1","1:5.3.2-1","1:5.4.5-1","1:5.5.5-1","1:5.5.8-1","1:5.6.6-1","1:5.6.6-2","1:5.9.4-1","1:6.0.3-1","1:6.0.4-1","1:6.0.4-2","1:6.0.5-1","1:6.0.6-1","1:6.0.7-1","1:6.0.7-2","1:6.0.7-3","1:6.0.7-4","1:6.0.7-5","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1","1:6.1.6-1","1:6.1.6-2","1:6.1.6-3","1:6.1.7-1","1:6.1.7-2","1:6.1.7-3","1:6.1.7-4","1:6.2.1-1","1:6.2.1-2","1:6.2.10-1","1:6.2.10-2","1:6.2.11-1","1:6.2.12-1","1:6.2.2-1","1:6.2.2-2","1:6.2.3-1","1:6.2.3-2","1:6.2.5-1","1:6.2.6-1","1:6.2.7-1","1:6.2.8-1","1:6.2.9-1","1:7.0.1-1","1:7.0.1-2","1:7.0.2-1","3.3.6-2","3.3.6-2.0.1","3.4.3-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"unrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"unrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"unrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.3.2-1","1:5.3.2-1+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.5.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.6-2ubuntu0.1"}]}],"versions":["1:5.6.6-2","1:5.6.6-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.5-1ubuntu0.1"}]}],"versions":["1:6.0.5-1","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.6.6-2ubuntu0.1"}]}],"versions":["1:5.6.6-2","1:5.6.6-2build1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"unrar-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.1.5-1ubuntu0.1"}]}],"versions":["1:6.0.5-1","1:6.0.7-6","1:6.1.2-1","1:6.1.3-1","1:6.1.3-2","1:6.1.4-1","1:6.1.5-1"],"bundled":4}],"products":[{"vendor":"rarlab","product":"unrar"},{"vendor":"rarlab","product":"winrar"}],"references":[{"url":"https://www.rarlab.com/rarnew.htm","tags":["x_transferred","Release Notes","advisory"]},{"url":"https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33899"},{"url":"https://github.com/advisories/GHSA-7m59-rfr2-gh4p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-33899","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241975-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225661","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-33899","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-33899","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-33899","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7350-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-30333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40477","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-33899","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","status":"published","published":"2024-04-28T00:00:00Z","modified":"2024-08-02T02:42:59.602Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:34:21.784174Z"}],"euvd":[{"id":"EUVD-2024-31603","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","status":"published","published":"2024-04-28T00:00:00Z","modified":"2024-08-02T02:42:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:21.347751Z"}],"ghsa":[{"id":"GHSA-7m59-rfr2-gh4p","title":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen...","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","status":"published","published":"2024-04-29T00:30:42Z","modified":"2024-07-03T18:37:15Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:57:34.925398Z"}],"nvd":[{"id":"CVE-2024-33899","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","status":"published","published":"2024-04-29T00:15:07.773Z","modified":"2026-06-17T07:32:31.86Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-150"],"updated_at":"2026-11-02T14:09:55.124919Z"}],"osv":[{"id":"CVE-2024-33899","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","status":"published","published":"2024-04-29T00:15:07.773Z","modified":"2026-03-14T12:33:25.568404Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-33899","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","status":"published","published":"2024-04-29T00:15:07.773Z","modified":"2026-11-02T12:02:22.181562256Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"UBUNTU-CVE-2024-33899","description":"RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.","status":"published","published":"2024-04-29T00:15:00Z","modified":"2026-04-22T14:49:38.002309Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"SUSE-SU-2024:1975-1","title":"Security update for unrar","description":"This update for unrar fixes the following issues:\n\n- CVE-2024-33899: Fixed a denial of service via ANSI escape squences. (bsc#1225661)\n","status":"published","published":"2024-06-11T07:35:47Z","modified":"2026-02-04T02:59:47.594399Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-7350-1","title":"unrar-nonfree vulnerabilities","description":"It was discovered that UnRAR incorrectly handled certain paths. If a user\nor automated system were tricked into extracting a specially crafted RAR\narchive, a remote attacker could possibly use this issue to write arbitrary\nfiles outside of the targeted directory. (CVE-2022-30333, CVE-2022-48579)\n\nIt was discovered that UnRAR incorrectly handled certain recovery volumes.\nIf a user or automated system were tricked into extracting a specially\ncrafted RAR archive, a remote attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2023-40477)\n\nSiddharth Dushantha discovered that UnRAR incorrectly handled ANSI escape\nsequences when writing screen output. If a user or automated system were\ntricked into processing a specially crafted RAR archive, a remote attacker\ncould possibly use this issue to spoof screen output or cause a denial of\nservice. (CVE-2024-33899)\n","status":"published","published":"2025-03-12T16:19:29Z","modified":"2026-10-27T04:15:48.83070674Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}