CVE-2026-14191
Published: July 1st, 2026
An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.
HIGH
CVSS v3: 7.8
CVSS v3: 7.8
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 26.2 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 26.1 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 25.4 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 25.3 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 25.2 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 25.1 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 24.4 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 24.4.0 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 24.3 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 24.2 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 24.1 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 23.3 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 23.2 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 23.1 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 22.4 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 22.3 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 22.2 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 22.1 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 21.11 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 21.8 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 21.5.0 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 21.2.0 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.19.3667 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.18.3599 | unrar (5.9.1) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.16.3445 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.15.3368 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.14.3263 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.13.3179 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.12.3054 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.11.3040 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.11.2990 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.10.2934 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.9.2878 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
| 11.4.8.2822 | unrar (5.3.9) | Not Affected | Code Not Reachable | The vulnerable function RecVolumes5::ReadHeader in recvol5.cpp is compiled into the product (recvol.cpp #includes recvol5.cpp), but the recovery-volume (.rev) code path is unreachable in Document Filters. Every entry point into it – RecVolumesTest (extract.cpp:124 and :225) and RecVolumesRestore (extract.cpp:339 and volume.cpp:90) – is guarded by preprocessor conditions that exclude the code when RARDLL is defined (‘#if !defined(SFX_MODULE) && !defined(RARDLL)’ and ‘#ifndef RARDLL’). Document Filters builds unrar with RARDLL defined (external/CMakeLists.txt) and drives the library exclusively through the DLL API (RAROpenArchiveEx followed by RARProcessFile RAR_TEST/RAR_SKIP in filters/isysreaders/readers/ReaderRAR.cpp). It never performs a recovery, repair, or .rev test operation, so RecVolumes5::ReadHeader is never called and the out-of-bounds write cannot be triggered. |
Severity score breakdown
Attack Complexity
LOW
Attack Vector
LOCAL
Availability Impact
HIGH
Base Score
7.8
Base Severity
HIGH
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
REQUIRED
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Version
3.1