Do you use WinRAR application? The developers of the app fixed a critical code execution vulnerability (CVE-2023-40477) in the software and you should update immediately.
WinRAR is a file archiver that runs on Windows and is used by millions of users. The program can be used to create files in RAR or ZIP archive format, but also to decompress many archive file formats. To allow the user to verify the integrity of files, WinRAR uses CRC32 or BLAKE2 checksums for each file.
However, older versions of the program contain a highly problematic vulnerability. The problem was discovered by the Zero Day Initiative, which reported the vulnerability in this post from August 17, 2023.
CVE-2023-40477 (RaRLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability) is listed with a CVSS score of 7,8 because it allows code execution. Allows remote attackers to execute arbitrary code on affected RARLAB WinRAR installations. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file.
The vulnerability exists in the processing of recovery volumes and results from a lack of proper data validation. This can lead to memory access beyond the bounds of an allocated buffer. An attacker could exploit this vulnerability to run code within the current process.
RARLAB has released an update to fix the problem.
More information at:
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa
