{"id":"CVE-2023-38831","published":"2023-08-23T17:15:43Z","modified":"2026-08-05T05:16:38Z","title":"RARLAB WinRAR Code Execution Vulnerability","vendor":"RARLAB","product":"WinRAR","tier":"core","eol":null,"description":{"text":"RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw lies in RARLAB WinRAR before version 6.23, where WinRAR processes the contents of a folder inside a ZIP archive when a user attempts to open a benign-looking file that shares the folder's name. An attacker who can get a user to open such a crafted ZIP archive in WinRAR can execute arbitrary code, provided the user takes an action to view the benign file and no authentication is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:26Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99815,"percentile":0.99959,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-08-24","dueDate":"2023-09-14","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"http://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa;  https://nvd.nist.gov/vuln/detail/CVE-2023-38831","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-07-10","exploitedFirstSeen":"2023-07-10","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2023-07-10"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38831","date":"2023-08-23"},{"url":"https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/","date":"2023-08-23"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-08-24"},{"url":"https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day","date":"2023-08-25"},{"url":"https://cert.gov.ua/article/5661411","date":"2023-08-30"},{"url":"https://mp.weixin.qq.com/s/1J4JNqLVUST6PsAWwoQ1CQ","date":"2023-09-14"},{"url":"https://paper.seebug.org/3033","date":"2023-09-18"},{"url":"https://cyble.com/blog/winrar-vulnerability-puts-illicit-content-consumers-at-risk-of-apanyan-stealer-murk-stealer-asyncrat/","date":"2023-10-09"},{"url":"https://cyble.com/blog/threat-actor-deploys-mythics-athena-agent-to-target-russian-semiconductor-suppliers/","date":"2023-10-10"}],"evidenceTotal":108,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"},{"id":"CWE-351","name":"Insufficient Type Distinction"}],"references":[{"url":"http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/","tags":["Exploit","Third Party Advisory"]},{"url":"https://news.ycombinator.com/item?id=37236100","tags":["Issue Tracking"]},{"url":"https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/","tags":["Exploit","Third Party Advisory"]},{"url":"https://news.ycombinator.com/item?id=37236100","tags":["Issue Tracking"]},{"url":"https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/","tags":["Exploit","Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831","tags":["US Government Resource"]}],"techniques":[{"id":"T1204","name":"User Execution","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"low","confidenceNote":"technique is for ESXi, Linux, Network Devices, macOS; product runs on Windows"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1112","name":"Modify Registry","tactics":["defense-impairment","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1587","name":"Develop Capabilities","tactics":["resource-development"],"provenance":"machine","basis":"report-attack-id","bases":["report-attack-id"],"basisDetail":"ATT&CK ID T1587 written in the same sentence as CVE-2023-38831","mappingType":null,"evidence":[{"reportId":"SRC-39aeb83e6c5e69480553","quote":"providers such as Private Internet Access,\r\nWindscribe, Express VPN, NordVPN, and Urban VPN\r\nAcquire Infrastructure T1583 ASA has obtained operational servers from its cover-hosting resellers\r\n(server-speed[.]com and more recently vps-agent[.]net)\r\nDevelop Capabilities T1587 Weaponization of CVE 2023-38831","start":19523,"end":19830}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-39aeb83e6c5e69480553","title":"Microsoft Word - JCSA-20241030-001","publisher":"ic3.gov","url":"https://www.ic3.gov/csa/2024/241030.pdf","date":null,"mentions":[{"quote":"providers such as Private Internet Access,\r\nWindscribe, Express VPN, NordVPN, and Urban VPN\r\nAcquire Infrastructure T1583 ASA has obtained operational servers from its cover-hosting resellers\r\n(server-speed[.]com and more recently vps-agent[.]net)\r\nDevelop Capabilities T1587 Weaponization of CVE 2023-38831","start":19523,"end":19830}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-42604","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-42604","exploited":true,"exploitedSince":"2023-08-24","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":50,"skipped":10,"earliest":"2023-08-24","earliestUrl":"https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc","repos":[{"name":"b1tg/CVE-2023-38831-winrar-exploit","url":"https://github.com/b1tg/CVE-2023-38831-winrar-exploit","stars":781,"created":"2023-08-25"},{"name":"Garck3h/cve-2023-38831","url":"https://github.com/Garck3h/cve-2023-38831","stars":127,"created":"2023-08-27"},{"name":"ignis-sec/CVE-2023-38831-RaRCE","url":"https://github.com/ignis-sec/CVE-2023-38831-RaRCE","stars":113,"created":"2023-08-27"},{"name":"BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc","url":"https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc","stars":91,"created":"2023-08-24"},{"name":"HDCE-inc/CVE-2023-38831","url":"https://github.com/HDCE-inc/CVE-2023-38831","stars":89,"created":"2023-08-28"}]},"metasploit":[{"name":"WinRAR CVE-2023-38831 Exploit","module":"exploit/windows/fileformat/winrar_cve_2023_38831","type":"exploit","disclosureDate":"2023-08-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_cve_2023_38831.rb"}],"first":{"date":"2023-08-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_cve_2023_38831.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html","https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/","https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/","https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/"],"flow":[{"stage":"exploitation","techniques":["T1204"],"provenance":"source"},{"stage":"secondary","techniques":["T1053","T1112","T1005","T1105","T1041","T1486"],"provenance":"source"},{"stage":"related","techniques":["T1059.004"],"provenance":"source","lowConfidence":true},{"stage":"observed","techniques":["T1587"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2023-07-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2023-08-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38831","provenance":"source"},{"date":"2023-08-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-08-24","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/winrar_cve_2023_38831.rb","provenance":"source"},{"date":"2023-08-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-08-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-42604","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1},"priority":{"score":82.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1207 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 50 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}