---
id: CVE-2023-38831
title: >-
  RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a
  user attempts to view a benign file within a ZIP archive
summary: >-
  RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a
  user attempts to view a benign file within a ZIP archive. The issue occurs
  because a ZIP archive may include a benign file (such as an ordinary .JPG
  file) and al…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-345
  - CWE-351
vendor: rarlab
product: winrar
affected:
  - winrar < 6.23
patched:
  - winrar 6.23
published: '2023-08-23'
updated: '2026-08-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-38831'
references:
  - url: >-
      http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html
    label: cve@mitre.org
  - url: >-
      https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
    label: cve@mitre.org
  - url: 'https://news.ycombinator.com/item?id=37236100'
    label: cve@mitre.org
  - url: >-
      https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/
    label: cve@mitre.org
  - url: 'https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/'
    label: cve@mitre.org
  - url: >-
      http://packetstormsecurity.com/files/174573/WinRAR-Remote-Code-Execution.html
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://news.ycombinator.com/item?id=37236100'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38831
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.99815
epssPercentile: 0.99958
kev: true
kevDateAdded: '2023-08-24'
kevDueDate: '2023-09-14'
kevRansomware: true
exploited: true
zeroDay: true
ingestedAt: '2026-08-05T05:45:57.589Z'
exploits:
  github: 58
  githubRepos:
    - 'https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc'
    - 'https://github.com/b1tg/CVE-2023-38831-winrar-exploit'
    - 'https://github.com/IR-HuntGuardians/CVE-2023-38831-HUNT'
  metasploit:
    - exploit/windows/fileformat/winrar_cve_2023_38831
  checkedAt: '2026-09-25T08:20:41.768Z'
exploitAvailable: true
---

## Overview

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

## Affected

- `winrar < 6.23`

## Remediation

Upgrade past the affected range:

- `winrar 6.23`