A critical vulnerability in WinRAR, tracked as CVE-2025-8088, has been exploited in phishing attacks to install the RomCom malware. This zero-day flaw, a directory traversal vulnerability, was identified in versions of WinRAR prior to 7.13 and allows attackers to extract files to user-defined paths, facilitating remote code execution. 'When extracting a file, versions of WinRAR can be manipulated into using a path defined in a specially crafted archive,' noted the changelog from WinRAR. ESET researchers first reported the active exploitation of this vulnerability in phishing emails containing malicious RAR file attachments, highlighting the serious risk to users who have not updated their software. The Russian-linked hackers behind these attacks have been observed leveraging this vulnerability to compromise systems, leading to critical security concerns across various sectors.
The vulnerability was discovered by ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček. 'This flaw allows attackers to create archives that extract executables into paths like the Windows Startup folder, which will run the executable at user login,' stated Strýček. While WinRAR version 7.13 has addressed this issue, users are urged to manually download the latest version as the application lacks an auto-update feature.
The vulnerability specifically affects Windows versions of WinRAR and does not impact Unix versions or RAR for Android. Phishing campaigns utilizing this exploit have been reported to contain RAR files that, when opened, execute the RomCom malware. This malware has been characterized by its ability to establish a foothold on compromised systems, potentially leading to further attacks.
Following the discovery of the vulnerability, security experts have indicated that users must act quickly to protect themselves. 'It's crucial for all users to update to version 7.13 or later to safeguard against this threat,' emphasized a spokesperson from ESET. The security community has also reacted with urgency, advising organizations to implement additional phishing detection measures to counteract the ongoing attacks.
In response to this threat, WinRAR users are advised to visit win-rar.com to download the necessary updates. Organizations and individuals should also consider implementing multi-factor authentication and regularly educating users about the risks of phishing emails. As noted by ESET, 'The best defense is always to stay updated and vigilant against such evolving threats.' This incident highlights the ongoing challenges in maintaining software security and the importance of prompt updates in mitigating vulnerabilities.
