WinRAR Vulnerability CVE-2025-8088: Check Your Version and Update

If you use WinRAR on Windows, check that it is version 7.13 or later. Older versions have a flaw, CVE-2025-8088, that lets a booby-trapped RAR archive drop malware into your Windows Startup folder when you extract it. On November 3, 2026, ESET reported that a Russia-aligned group it calls Gorbag has been sending archives that exploit this bug since early 2026. WinRAR does not update itself, so the fix is to install the current release, 7.23, from rarlab.com.

Below: what ESET found, how the attack works, how to check your version, how to update safely, and how to look for signs that a bad archive already ran.

Before you start

Applies to: WinRAR for Windows, plus the Windows versions of RAR and UnRAR, UnRAR.dll and the portable UnRAR source code, as listed by ESET
You need: an administrator account on the PC to install the update
Time: about 5 minutes to check and update; 15 more for the Startup folder check and a scan
Key fact: version 7.12 and earlier are vulnerable. 7.13, released July 30, 2025, fixed the flaw

What ESET reported on November 3

ESET’s Gorbag research describes a group stealing documents and credentials from Ukrainian organizations near the front line, including courts, city councils and defense-related bodies. Through 2025 it relied on spearphishing emails with lures about administrative fines or taxes. In early 2026 it switched to weaponized RAR archives that exploit CVE-2025-8088, and then installed simple infostealers, including one ESET calls BeautyStealer, that collect files by extension (.txt, .doc and others) and any credentials stored in plain text.

The targets so far are Ukrainian, so most readers are not Gorbag’s audience. The reason to act anyway is that the exploit is not exclusive to one group. ESET found the flaw being used by a different Russia-aligned group, RomCom, when it discovered it in July 2025, and Gorbag only adopted it in early 2026, months after the July 2025 patch. An exploit that still works that long after a fix tells you how many copies of WinRAR never get updated.

How the WinRAR exploit works

CVE-2025-8088 is a path traversal bug involving alternate data streams (ADS), a Windows file system feature that lets extra hidden data ride along with a file. According to ESET’s original advisory, a crafted archive looks like it contains one harmless file, such as a CV. When an unpatched WinRAR extracts it, hidden streams are written outside the folder you chose:

a shortcut (.lnk) file lands in the Windows Startup folder, so it runs the next time you sign in
a DLL or EXE lands in %TEMP% or %LOCALAPPDATA%, ready for that shortcut to launch

Nothing obvious happens at extraction time. The malware starts at your next sign-in.

WinRAR version	Status for CVE-2025-8088
7.12 and earlier (including all 6.x)	Vulnerable, update now
7.13 (July 30, 2025)	Patched
7.23 (current stable on rarlab.com, Nov 4, 2026)	Patched, recommended
7.30 beta 2	Beta build; stick with 7.23 unless you need beta features

How to check your WinRAR version

Open WinRAR.
Click Help > About WinRAR. The version number is shown at the top of the window.
Alternatively, open Settings > Apps > Installed apps in Windows 11, search for WinRAR, and read the version under its name.

If the number is below 7.13, update before you open another archive.

How to update WinRAR safely

Go to the official download page at rarlab.com/download.htm. Avoid download aggregator sites, which sometimes bundle extra installers.
Download WinRAR 64-bit 7.23 (or the ARM64 build on a Snapdragon PC). Pick the stable release, not the 7.30 beta.
Close WinRAR, then run the installer. Installing over the old version upgrades it in place.
Open Help > About WinRAR again and confirm it now reads 7.23.

If other software on your PC ships its own UnRAR.dll, as some file managers and backup tools do, that copy needs an update from its own vendor. Updating WinRAR does not touch it.

Check whether a bad archive already ran

If you extracted RAR files from email attachments or unfamiliar downloads with an old WinRAR this year, spend 15 minutes on these checks:

Press Windows + R, type shell:startup and press Enter. Look for shortcuts you don’t recognize, especially ones with recent dates.
Repeat with shell:common startup, which opens the Startup folder shared by all users.
Open Task Manager > Startup apps and check for unknown entries.
Run a full scan: Windows Security > Virus & threat protection > Scan options > Full scan > Scan now.

If you find something suspicious, disconnect the PC from the network, don’t sign in to sensitive accounts from it, and change passwords from a different device. BeautyStealer-style tools go after documents and saved credentials, so treat any file on that machine as possibly copied. Our AOMEI Backupper malware check walks through a similar clean-up, and a fresh Windows 11 backup before any reset protects your files.

Do you need WinRAR at all?

Windows 11 can open RAR, 7z and tar archives in File Explorer without extra software, which covers most people who only extract the occasional download. If you keep WinRAR for creating archives or for its repair tools, keep it, but add a reminder to check rarlab.com every few months, because the app won’t tell you when a security fix ships.

Frequently asked questions

Does WinRAR update automatically?

No. You have to download and install new versions yourself, which is why so many PCs still run vulnerable builds.

Is WinRAR on Mac or Android affected?

ESET’s advisory lists only Windows components: WinRAR, the Windows RAR and UnRAR command-line tools, UnRAR.dll and the portable UnRAR source code.

Will updating remove my license or settings?

Installing over the old version is how RARLAB expects you to upgrade, and your registration key file stays in the WinRAR folder. We have not verified how every custom setting carries over, so note any you depend on before upgrading.

Can my antivirus block this?

It may catch the malware that gets dropped, but it can’t fix the bug in WinRAR itself. Update regardless.

What to do next

Check Help > About WinRAR on every Windows PC you use, update anything below 7.13 to 7.23 from rarlab.com, and run the Startup folder check on any machine where you opened RAR attachments this year. For another Windows app that needed a manual security update recently, see our NordVPN Windows vulnerability guide.

Sources

Checked on November 4, 2026. Attack details come from ESET’s research; we did not test malicious archives. Current version numbers were read from RARLAB’s download page on November 4.