---
id: "CVE-2023-38831"
kind: "vulnerability"
aliases: ["CVE-2023-38831"]
title: "RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "rarlab winrar", "fixed": ["6.23"], "affected": "< 6.23", "ecosystem": "vendor"}, {"name": "RARLAB WinRAR", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["end-users", "exploited", "package", "ransomware", "windows", "winrar"]
not_affected_if: ["not-installed"]
published_at: "2023-08-23T17:15:43+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-38831", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38831", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file…

WinRAR, a Windows archive tool, has a flaw that lets an attacker run code when a user opens a harmless-looking file inside a ZIP archive. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:rarlab winrar affected < 6.23 fixed 6.23
- vendor:RARLAB WinRAR affected ? fixed ?

## How to check

Check the installed WinRAR version (Help > About WinRAR) against the vendor's fixed release.

## Fix

Update WinRAR to the vendor's patched release; if no mitigation is available, stop using WinRAR per CISA's required action.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-38831
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-38831

## From the sources

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_