Threat Advisory

Critical Zero-Day Vulnerability in WinRAR Exploited via Malicious Archives

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High

EXECUTIVE SUMMARY:

A critical zero-day vulnerability in WinRAR CVE-2025-6218 is being actively exploited and sold on the dark web. This flaw allows attackers to silently execute arbitrary code upon opening a malicious archive, putting millions of Windows users at risk.

  • CVE-2025-6218: This vulnerability has a CVSS v3.0 score of 7.8. The flaw lies in how WinRAR parses specially crafted archive files, enabling attackers to trigger remote code execution simply by convincing a victim to open a malicious archive. The exploit requires minimal user interaction and bypasses built-in Windows security controls.

Once exploited, attackers can deploy malware, gain persistence, steal data, or conduct follow-on attacks. Given the tool's widespread use and low detection rate by antivirus engines, this vulnerability represents a severe threat, especially as it’s already circulating on underground forums.

RECOMMENDATION:

  • We strongly recommend you update WinRAR version to 7.12 or later.

REFERENCES:

The following reports contain further technical details:

crossmenu