CVE-2026-14191: 
WinRAR vulnerability analysis and mitigation

CVE-2026-14191 is an out-of-bounds heap write vulnerability in the RAR5 recovery-volume (.rev) parser in RARLAB WinRAR, RAR, UnRAR, and UnRAR.dll. The flaw resides in RecVolumes5::ReadHeader in recvol5.cpp, where the RecItems vector is sized only when the first .rev file in a set is processed, but subsequent .rev files can supply an independent RecNum value that is never validated against the actual allocation size. It affects WinRAR and RAR versions before 7.23, UnRAR versions up to and including 7.21, and UnRAR.dll versions before 7.23. Disclosed on July 1, 2026, it carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-129 (Improper Validation of Array Index) and CWE-787 (Out-of-bounds Write). When processing a set of two or more crafted .rev files, the RecNum value from each subsequent file is validated only against that file's own TotalCount field — not against the actual size of the RecItems vector allocated during processing of the first file. This allows an attacker to write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an offset up to 65534 * sizeof(RecVolItem) bytes past the end of the allocation, corrupting adjacent heap objects. Exploitation requires user interaction: the victim must perform a recovery or test operation on an attacker-supplied .rev set (e.g., unrar t x.part1.rev, WinRAR's 'Repair archive' function, or auto-recovery triggered when extracting a volume set with a missing .rar part). This vulnerability is the RAR5-path sibling of CVE-2023-40477, which was fixed only in the RAR3 path in WinRAR 6.23 (Github Advisory, Feedly).

Successful exploitation can result in high confidentiality, integrity, and availability impact on the affected system. By corrupting adjacent heap objects, an attacker may achieve arbitrary code execution in the context of the user running WinRAR or UnRAR, potentially enabling full system compromise, data theft, or application crashes. The attack vector is local and requires user interaction, limiting mass exploitation, but the technical impact is rated as total by CISA's SSVC assessment (Github Advisory, Feedly).

1. Craft malicious .rev files: Create a set of two or more RAR5 recovery volume (.rev) files where the first file establishes a RecItems vector of a specific size, and subsequent files contain a manipulated RecNum value exceeding the allocated vector size, along with a controlled RevCRC value to be written out-of-bounds.
2. Deliver the malicious archive set: Distribute the crafted .rev files alongside a multi-part RAR archive set to the victim, for example via email attachment, file sharing, or a malicious download page. Optionally, omit one .rar part to trigger auto-recovery.
3. Induce victim interaction: Social-engineer the victim into performing one of the following triggering operations: running unrar t x.part1.rev on the command line, using WinRAR's 'Repair archive' function on the crafted set, or extracting a multi-part archive set where a .rar part is missing (triggering auto-recovery).
4. Trigger heap corruption: When RecVolumes5::ReadHeader processes the second (or later) .rev file, the unvalidated RecNum index causes the RevCRC value to be written to RecItems[RecNum] far past the end of the allocated buffer, corrupting adjacent heap objects.
5. Achieve code execution: Depending on heap layout and OS memory protections, the heap corruption may be leveraged to redirect execution flow and run arbitrary code in the context of the current user process (Github Advisory, Feedly).

• File System: Presence of unexpected or unsolicited multi-part .rev file sets (especially with two or more .rev files and a missing corresponding .rar part) in download directories, temp folders, or email attachments.
• Process: Unusual child processes spawned by WinRAR or UnRAR (e.g., cmd.exe, powershell.exe, sh, curl, wget) following a recovery or test operation on a .rev set.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing WinRAR.exe or unrar.exe with access violation or heap corruption errors after processing .rev files.
• Network: Unexpected outbound network connections from the WinRAR or UnRAR process shortly after a recovery operation, potentially indicating a reverse shell or data exfiltration attempt.

RARLAB has released fixed versions: WinRAR/RAR 7.23 and UnRAR 7.22 or later address this vulnerability. Users should update to WinRAR/RAR 7.23 or UnRAR 7.22+ immediately via the RARLAB download page. As interim mitigations: avoid processing .rev files from untrusted or unknown sources; disable auto-recovery features if not operationally required; and exercise caution when performing recovery or test operations on multi-part archive sets received from external parties (Github Advisory, Feedly).

Security news outlets including Cybersecurity News, Malwarebytes, VPNcentral, and SecurityOnline covered the vulnerability shortly after disclosure, with headlines highlighting the heap overflow risk and the availability of the WinRAR 7.23 patch (Malwarebytes Blog, Cybersecurity News). Community discussion on Reddit's r/sysadmin noted the vulnerability and the absence of a CVE EPSS score at the time, with users urging prompt patching. The Hacker News weekly recap also referenced the vulnerability in the context of broader security news. The vulnerability was assigned by Securin and is described as the RAR5-path sibling of the previously exploited CVE-2023-40477, drawing comparisons in community commentary.