erroneo.us
Search all guides⌘K

Security Digest · Aug 11, 2025 · Vulnerability · Other

WinRAR CVE-2025-8088: ADS Path Traversal Exploited by RomCom

WinRAR for Windows up to 7.12 lets crafted RAR files drop malware into Startup; exploited by RomCom and many others. Update to 7.13+ and check for stale copies.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Check exposure

Fixed since July 2025 but still heavily exploited, and WinRAR does not update itself, so hunt down every copy at 7.12 or older and update it today.

Who must act: Anyone running WinRAR, the Windows RAR/UnRAR tools, or software that bundles an old UnRAR.dll on Windows, especially if users open RAR attachments from email.

Who can relax: Linux/Unix RAR builds and RAR for Android users, and Windows fleets already verified at WinRAR 7.13 or later.

Affected
WinRAR for Windows 7.12 and earlier
Windows versions of RAR and UnRAR command line utilities before 7.13
UnRAR.dll and portable UnRAR source code before the 7.13 fix, including third-party software that embeds them
Fixed in
WinRAR 7.13 (released July 30, 2025) and later
CVSS
8.4 (v4.0, CNA)
EPSS
94.5% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory WinRAR versions on every Windows endpoint (Help > About, or file version of WinRAR.exe in Program Files) and update anything at 7.12 or older to the current release.
  2. Find third-party products that ship UnRAR.dll and apply their vendor updates.
  3. Block or quarantine RAR attachments from external senders at the mail gateway where business need allows.
  4. Alert on archive extraction writing .lnk, .hta, .bat, .cmd or .dll files into user Startup folders, %TEMP% or %LOCALAPPDATA%.
  5. Retro-hunt using ESET's published RomCom IOCs and GTIG's indicators.

How to check if you are affected or compromised

  • Look for files created under %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup with WinRAR.exe as the creating process.
  • Search mail and download logs for RAR files with job-application or CV lures (e.g. cv_submission.rar, JobDocs_July2025.rar) or hotel-booking themes.
  • Check HKCU\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32 for a COM hijack used by RomCom's Mythic loader.
  • Inspect suspicious archives for alternate data stream entries (name.ext:stream) containing ..\ traversal sequences.

What happened#

On August 11, 2025, ESET published research showing that a WinRAR zero-day, now CVE-2025-8088, had been used in spearphishing between July 18 and 21, 2025. ESET attributes the campaign with high confidence to RomCom (also tracked as Storm-0978, Tropical Scorpius and UNC2596). The targets were financial, manufacturing, defense and logistics companies in Europe and Canada. ESET says none of those targets were compromised.

The trick abuses NTFS alternate data streams (ADS). A RAR archive appears to hold one harmless file, such as a CV. Hidden ADS entries carry ..\ traversal paths, and a vulnerable WinRAR follows them. That drops a DLL into %TEMP% or %LOCALAPPDATA% and a shortcut into the Windows Startup folder, so the malware runs at the next logon. The payloads ESET observed were a Mythic agent, a SnipBot variant and the RustyClaw downloader.

ESET reported the bug on July 24, and RARLAB shipped a fix in a beta the same day. WinRAR 7.13 final followed on July 30, 2025. The CVE record, assigned by ESET, carries a CVSS 4.0 score of 8.4.

Who is affected#

The bug affects WinRAR for Windows through 7.12, the Windows RAR/UnRAR command line tools, UnRAR.dll and the portable UnRAR source code. Third-party software built on outdated UnRAR code is affected too. RARLAB states that Linux/Unix builds and RAR for Android are not affected.

Do you really need to act?#

If WinRAR is in your fleet, yes. Patch adoption here is weak. WinRAR has no silent auto-update, so old copies linger on endpoints for years. Exploitation has also spread well beyond RomCom. In January 2026, Google's Threat Intelligence Group reported the flaw being used by several Russia-nexus groups (including APT44, Turla and TEMP.Armageddon), a China-nexus actor, and financially motivated crews. Those crews pushed XWorm, AsyncRAT and banking-credential stealers. GTIG saw activity continuing into January 2026 and described an underground seller advertising the exploit in July 2025. CISA added the CVE to the KEV catalog on August 12, 2025.

The bar for exploitation is low: a user opens a RAR attachment and extracts it with a vulnerable build. The user sees error messages about odd paths, but by then the files are written. The bar for defenders is also low: update the software. That is why the verdict is "check exposure", not "relax". Most organizations patched in 2025. The risk now sits in the copies nobody remembers installing.

What to do now#

  1. Inventory WinRAR on Windows endpoints. In PowerShell: (Get-Item "C:\Program Files\WinRAR\WinRAR.exe").VersionInfo.ProductVersion, or use your software inventory tool. Update anything at 7.12 or older.
  2. Find products that bundle UnRAR.dll, such as file managers, backup tools and scanners, and apply their vendor updates.
  3. Where the business allows it, quarantine RAR attachments from external senders at the mail gateway.
  4. Add an EDR rule for archive tools writing .lnk, .hta, .bat, .cmd or .dll files into Startup, %TEMP% or %LOCALAPPDATA%.
  5. Retro-hunt with ESET's IOCs (its malware-ioc GitHub repository, romcom folder) and GTIG's indicators.

How to tell if you were hit#

Look for new shortcuts or scripts in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup created by WinRAR.exe. Check mail logs for lures like the ones ESET listed (cv_submission.rar, JobDocs_July2025.rar, Recruitment_Dossier_July_2025.rar). GTIG also saw hotel-booking and Ukrainian-government themes. RomCom's Mythic loader used a COM hijack under HKCU\SOFTWARE\Classes\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\InprocServer32. If you find any of these, treat the host as compromised: isolate it, collect evidence and reimage.

Timeline#

  • — ESET spots a malicious RAR archive. RomCom spearphishing runs through July 21.
  • — ESET notifies RARLAB, which ships the fix in WinRAR 7.13 beta 1 the same day.
  • — WinRAR 7.13 final is released.
  • — CVE-2025-8088 record is published.
  • — ESET publishes its research.
  • — CISA adds the CVE to KEV (federal due date September 2, 2025).
  • — GTIG reports widespread ongoing exploitation by state and criminal actors.

Vulnerability records

  • CVE-2025-8088 · KEV 2025-08-12 · A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. ESET WeLiveSecurity — Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability welivesecurity.com
  2. RARLAB — WinRAR 7.13 release news win-rar.com
  3. CVE Program — CVE-2025-8088 record (JSON) cveawg.mitre.org
  4. Google Threat Intelligence Group — Exploitation of critical WinRAR vulnerability CVE-2025-8088 (Jan 2026) cloud.google.com
  5. CISA — Known Exploited Vulnerabilities Catalog cisa.gov