7.5High

CVE-2024-36052

rarlab winrar Published: 2024-05-21 19:37 (2 years ago)

Description

RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899.

Weakness (CWE): CWE-150

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
rarlab	winrar	< 7.00

References and patches

CVSS score

7.5High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS (chance of exploitation in 30 days)

0.75%

higher than 55% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: yes
Technical impact: partial

Timeline

ID reserved2024-05-18
Published2024-05-21 19:37
Reached IP-DB2026-10-24 23:56
Last updated2025-02-13 18:59

Assigned by (CNA): mitre

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WinRAR

7.8High

CVE-2026-14191 4 months ago

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

RARLAB WinRAR; RARLAB RAR; RARLAB UnRAR; RARLAB UnRAR.dll

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an indepe…

6.2Medium

CVE-2019-25677 7 months ago

WinRAR 5.61 Denial of Service via Malformed Language File

Win-Rar WinRAR

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the t…

6.1Medium

CVE-2025-52331 1 year ago

rarlab winrar

Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes …

8.4High

CVE-2025-8088 KEV Used in ransomware 1 year ago

Path traversal vulnerability in WinRAR

win.rar GmbH WinRAR

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and …

94%EPSS

8.4High

CVE-2014-125119 1 year ago

WinRAR < 5.00 Filename Spoofing RCE

RARLab WinRAR

A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Cen…

2.0%EPSS

7.8High

CVE-2025-6218 KEV 1 year ago

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability

RARLAB WinRAR

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the targ…

90%EPSS