CVE-2019-25677
6.9
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Win-Rar | WinRAR | 5.61 32 Bit | affected |
Weaknesses
- CWE-379: Creation of Temporary File in Directory with Insecure Permissions
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
- https://www.exploit-db.com/exploits/46432
- https://win-rar.com/predownload.html?spV=true&subD=true&f=wrar561tr.exe
- https://www.vulncheck.com/advisories/winrar-denial-of-service-via-malformed-language-file
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.