Heise.De

WinRAR Vulnerability Exploited: Code Smuggling Attacks Observed

First seen 11 Dec 2025, 13:51 UTC •

•86% similarity •29.9

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A vulnerability in WinRAR, present until version 7.12 Beta 1, allows attackers to inject malicious code through specially crafted RAR files. The US cybersecurity agency CISA has added this vulnerability to its catalog of Known Exploited Vulnerabilities, indicating active exploitation. Users are advised to update to a newer version promptly to mitigate risks.

ThreatCluster AI How this analysis works

Attack Flow

10 entities, 12 inferred relationships (STIX 2.1).

Technique (4)

Malware
Phishing
Zero-day Exploit
T1566 - Spearphishing Attachment

Vulnerability (4)

CVE-2025-6218
CVE-2025-8088
Code Smuggling Vulnerability
WinRAR Zero-day Vulnerability

Affected Platform (1)

Windows

Tool (1)

WinRar

Relationships

WinRar exploits CVE-2025-6218
WinRar exploits CVE-2025-8088
WinRar exploits Code Smuggling Vulnerability
WinRar exploits WinRAR Zero-day Vulnerability
CVE-2025-6218 targets Windows
CVE-2025-8088 targets Windows
Code Smuggling Vulnerability targets Windows
WinRAR Zero-day Vulnerability targets Windows
Malware targets Windows
Phishing targets Windows
Zero-day Exploit targets Windows
T1566 - Spearphishing Attachment targets Windows

Community

Browse all →

Tracked Entities in This Story

Windows

WinRAR Vulnerability Exploited: Code Smuggling Attacks Observed

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story