CVE-2012-6706

Name of the Vulnerable Software and Affected Versions unrar versions prior to 5.5.5 Sophos Anti-Virus Threat Detection Engine versions prior to 3.37.2

Description A memory corruption issue was discovered in the VMSF DELTA component of the UnRAR file decompression tool. This issue is caused by an integer overflow when summing DataSize and CurChannel, resulting in a negative value of the DestPos variable. This allows an attacker to write out of bounds when setting Mem[DestPos], potentially leading to arbitrary code execution.

Recommendations For unrar versions prior to 5.5.5, update to version 5.5.5 or later to resolve the issue. For Sophos Anti-Virus Threat Detection Engine versions prior to 3.37.2, update to version 3.37.2 or later to resolve the issue.