CVE-2014-125119: WinRAR < 5.00 Filename Spoofing RCE
- Is it exploited?
Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .
VulnCheck KEV lists it since . It cites 2 public reports, the first from .
- How likely is exploitation in the next 30 days?
- 2%
Up from 1.8% on .
EPSS score, percentile 80.5 of all scored records. A probability estimated by FIRST, not a report of exploitation.
CISA's SSVC assessment in the CVE record lists exploitation as poc.
- How severe?
- 8.4 High
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- from 3.80 to before 3.91
- from 4.11 to before 5.00
Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
WinRAR < 5.00 Filename Spoofing RCE
A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (1 product)
| Status | Versions |
|---|---|
| Affected | from 3.80 to before 3.91 |
| Affected | from 4.11 to before 5.00 |
Versions not listed are: unaffected.
Source: CVE List, as of . About the data.
Weakness
CWE-20, CWE-434
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |
References
5
Known exploited RARLAB vulnerabilities
- CVE-2025-6218: RARLAB WinRAR Path Traversal Vulnerability
- CVE-2025-8088: RARLAB WinRAR Path Traversal Vulnerability
- CVE-2023-38831: RARLAB WinRAR Code Execution Vulnerability
- CVE-2022-30333: RARLAB UnRAR Directory Traversal Vulnerability
- CVE-2018-20250: WinRAR Absolute Path Traversal Vulnerability