CVE catalog

CVE-2026-14191

Severity: High · CVSS 7.8
Published: Jun 30, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.44% · Oct 25, 2026

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rar	sid	`2:7.23-1`	fixed
Debian	rar	forky	`2:7.23-1`	fixed
Debian	rar	trixie	`2:7.11-1`	vulnerable
Debian	rar	bookworm	`2:7.01-1~deb12u1`	vulnerable
Debian	unrar-nonfree	sid	`1:7.3.1-1`	fixed
Debian	unrar-nonfree	forky	`1:7.3.1-1`	fixed
Debian	unrar-nonfree	trixie	`1:7.1.8-1`	vulnerable
Debian	unrar-nonfree	bookworm	`1:6.2.6-1+deb12u1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rar	source	sid	`2:7.23-1`	not yet assigned	Not reported	Not reported
Debian	rar	source	forky	`2:7.23-1`	not yet assigned	Not reported	Not reported
Debian	rar	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	rar	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	unrar-nonfree	source	sid	`1:7.2.7-1`	not yet assigned	Not reported	Not reported
Debian	unrar-nonfree	source	forky	`1:7.2.7-1`	not yet assigned	Not reported	Not reported
Debian	unrar-nonfree	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	unrar-nonfree	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[trixie] rar: non-free not supported [bookworm] rar: non-free not supported [trixie] unrar-nonfree: non-free not supported [bookworm] unrar-nonfree: non-free not supported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libunrar5]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:6.2.6-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12
- 1:6.2.6-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12
[libunrar-dev]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:6.2.6-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12
- 1:6.2.6-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12
[libunrar-headers]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:6.2.6-1+deb12u1 · all · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12
- 1:6.2.6-1+deb12u1 · all · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12
[rar]Affected
Details (1)
- 2:7.01-1~deb12u1 · amd64 · bookworm
  Affected
  nvd · rar · debian · bookworm; nvd · rar · debian · 12
[unrar]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:6.2.6-1+deb12u1 · amd64 · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12
- 1:6.2.6-1+deb12u1 · arm64 · bookworm
  Affected
  nvd · unrar-nonfree · debian · bookworm; nvd · unrar-nonfree · debian · 12

[Debian 13 (Trixie)]

[libunrar5t64]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:7.1.8-1 · amd64 · trixie
  Affected
  nvd · unrar-nonfree · debian · 13
- 1:7.1.8-1 · arm64 · trixie
  Affected
  nvd · unrar-nonfree · debian · 13
[libunrar-dev]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:7.1.8-1 · amd64 · trixie
  Affected
  nvd · unrar-nonfree · debian · 13
- 1:7.1.8-1 · arm64 · trixie
  Affected
  nvd · unrar-nonfree · debian · 13
[libunrar-headers]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:7.1.8-1 · all · trixie
  Affected
  nvd · unrar-nonfree · debian · 13
- 1:7.1.8-1 · all · trixie
  Affected
  nvd · unrar-nonfree · debian · 13
[rar]Affected
Details (1)
- 2:7.11-1 · amd64 · trixie
  Affected
  nvd · rar · debian · 13
[unrar]Affected
Source package: [unrar-nonfree]
Details (2)
- 1:7.1.8-1 · amd64 · trixie
  Affected
  nvd · unrar-nonfree · debian · 13
- 1:7.1.8-1 · arm64 · trixie
  Affected
  nvd · unrar-nonfree · debian · 13

Observed: Oct 23, 2026, 9:45:13 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]