CVE-2026-14191: Rarlab WinRAR — Remote Code Execution via .rev Files (July 2026)

CVE-2026-14191 — Rarlab WinRAR

CVE-2026-14191 (high severity) is a vulnerability in Rarlab's WinRAR that allows remote code execution if a user opens a malicious recovery-volume (.rev) file. No evidence of active exploitation yet, but similar flaws have been targeted by nation-state groups in the past.

Attack Vector

Attackers craft specially designed .rev files that, when opened in vulnerable WinRAR versions, trigger an out-of-bounds write. This flaw enables arbitrary code execution on the target system. The attack requires user interaction—opening the malicious file—but can be delivered via phishing, drive-by downloads, or malicious archives. No specific IOCs are published for this CVE, but monitoring for unexpected .rev file activity is advised.

Who Is at Risk

All organizations and users running WinRAR versions prior to 7.23 are vulnerable, including both enterprise and individual deployments. Rarlab and all downstream WinRAR users are affected. The risk is heightened due to the lack of automatic updates—manual installation is required.

Patch & Mitigate

• Patch: Update to WinRAR version 7.23 immediately. Manual installation is required; there is no auto-update mechanism.
• Workaround: Do not open untrusted .rev files until patched.
• Detect: Audit for unexpected execution of WinRAR processes handling .rev files, and review endpoint logs for anomalous file activity involving recovery volumes.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers may deliver malicious .rev files via phishing or drive-by downloads.
• TA0005 — Defense Evasion: Malicious archives may bypass traditional security controls if not scanned or blocked.
• TA0040 — Impact: Successful exploitation allows full code execution and potential system takeover.

Source: https://www.malwarebytes.com/blog/news/2026/07/winrar-flaw-could-allow-attackers-to-take-control-of-your-computer