Target Industry
Indiscriminate, opportunistic targeting.
Overview
A zero day remote-code-execution (RCE) vulnerability for WinRAR, tracked as CVE-2025-6218 with a CVSS score 7.8, is being sold on the dark web. It allows threat actors to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. This issue arises because a ZIP archive may include a benign file (e.g., a .JPG file) and a folder with the same name, leading to the execution of malicious content within the folder when the benign file is accessed.
Impact
The impact of CVE-2023-38831 is significant, as it can lead to unauthorised code execution, data theft, and system compromise. Financially, organisations may face costs related to incident response, recovery, and potential regulatory fines. Operationally, the exploit can disrupt business processes and lead to loss of sensitive data, while reputational damage can result from public exposure of security breaches.
The potential implications of a zero-day exploit being sold on the dark web are:
- Crimeware-as-a-Service (CaaS) brokers using the exploit to create malicious documents (maldocs) that trick users into opening them, similar to past campaigns like CVE-2019-0969
- Software build servers that automatically unpack third-party archives could be targeted; if these servers are compromised, it could lead to widespread issues as they are integral to software development and deployment processes
- Initial-Access Brokers might buy the exploit to gain initial access to systems. They could then sell this access to ransomware groups.
Affected Products
The vulnerability CVE-2025-6218 affects RARLAB WinRAR versions up to, but excluding, 7.12. This vulnerability was patched by the vendor on 26th June 2025.
Exploitation
The exploitation of CVE-2023-38831 involves crafting ZIP archives that contain both benign files and folders with the same name, which can include malicious executables. When a user attempts to open the benign file, the exploit triggers the execution of the malicious content within the folder. This method can be executed through phishing emails that trick users into opening compromised archives. The exploit’s potential for RCE makes it particularly dangerous, as it can be triggered through seemingly innocent file operations.
Containment, Mitigations & Remediations
It is highly recommended to keep software updated with the latest versions, monitor for anomalous archive extraction behaviour, implementing strict file handling policies, using application sandboxing, and employing endpoint detection and response (EDR) solutions can further reduce the risk of exploitation.
Threat Landscape
WinRAR is installed on hundreds of millions of Windows systems, making this exploit a significant threat. Previous WinRAR RCE chains have involved abusing file-format parsing logic to trigger memory corruption. Threat actors typically craft archives with malformed headers or over-long filenames to corrupt the stack or heap.
Threat Group
It has been reported that a user named “zeroplayer” is selling a RCE exploit for WinRAR for $80,000 on the dark web. Several advanced persistent threat (APT) groups have also been associated with the exploitation of the WinRAR vulnerability, including DarkMe, UAC-0057, APT40, and SandWorm. These groups employ various tactics, such as phishing campaigns and embedding malicious executables within benign-looking files, to exploit the vulnerability and gain unauthorized access to systems
Further Information
