CVEブラウザに戻る

CVE-2025-8088

🔥 Known Exploited (CISA KEV)HIGH

8.4

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-08-08

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

Affected Platforms (CPE)

📦

Rarlab

Winrar

< 7.13

📦

Dtsearch

Dtsearch

< 2023.01

References & Advisories

🔗 https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5

🔗 https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/

🔗 https://support.dtsearch.com/faq/dts0245.htm

🔗 https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day

🔗 https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088

🔗 https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088

関連する脆弱性情報

CVE-2026-141917.8

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvo...

CVE-2019-256776.9

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed...

CVE-2025-141111.3

A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the ...

CVE-2025-523316.1

Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose ...