CVE-2023-38831: RARLAB WinRAR Code Execution Vulnerability. RARLAB WinRAR

RARLAB WinRAR Code Execution Vulnerability. RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.

• CISA KEV-listed (remediation due 2023-09-14)
• used in ransomware campaigns
• EPSS 98.0% (99.9% percentile)
• CVSS 7.8 high

Detection rules

• CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File high
• CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process high
• Potentially Suspicious Child Process Of WinRAR.EXE medium

Related briefings

• A spy trojan swaps zero-days for a plain phishing email 2026-09-23

Linked threat actors

• FlyingYeti machine-inferred link
• Opal Sleet machine-inferred link
• Head Mare machine-inferred link

Browse the CVE database

Read the full analysis on IntelFusions