CVE-2018-20252

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Check Point Software Technologies Ltd.	WinRAR	All versions prior and including 5.60

References

http://www.securityfocus.com/bid/106948Third Party Advisory, VDB Entry
https://research.checkpoint.com/extracting-code-execution-from-winrar/Exploit, Third Party Advisory
https://www.win-rar.com/whatsnew.htmlRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/106948Third Party Advisory, VDB Entry
https://research.checkpoint.com/extracting-code-execution-from-winrar/Exploit, Third Party Advisory
https://www.win-rar.com/whatsnew.htmlRelease Notes, Vendor Advisory

Timeline

Published: Feb 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-202537.8In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive CVE-2018-20264.3IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal pro CVE-2018-20286.5IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the atta CVE-2018-202986.5S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NT CVE-2018-202999.8An issue was discovered in several Bosch Smart Home cameras (360 degree indoor camera and Eyes outdoor camera) with firmware before 6.52.4. CVE-2018-203009.8Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this CVE-2018-203016.5An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registrat CVE-2018-203026.1An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.CVE-2018-203037.5In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a fi CVE-2018-203046.5wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argum CVE-2018-203059.8D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/fo CVE-2018-203065.4A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow