CVE-2026-14191

Name of the Vulnerable Software and Affected Versions WinRAR versions prior to 7.23 UnRAR versions prior to 7.23

Description An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser within the RecVolumes5::ReadHeader function in recvol5.cpp. The issue occurs because the RecItems vector is sized only during the processing of the first .rev file in a set. Subsequent .rev files provide an independent RecNum value that is validated against the file's own TotalCount field but not against the actual size of RecItems. A crafted set of two or more .rev files can allow an attacker to write a 32-bit value from the RevCRC field to RecItems[RecNum] at an offset up to 65534 * sizeof(RecVolItem) bytes beyond the allocation, leading to memory corruption of adjacent heap objects and potentially allowing remote code execution. This is triggered when a user performs a recovery or test operation on a malicious .rev set, such as using the 'Repair archive' feature in WinRAR or the unrar t command.

Recommendations Update WinRAR to version 7.23. Update UnRAR to version 7.23.