CVE-2014-125119

CVE-2014-125119 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including chr1x, juan vazquez, including a Metasploit module exploits/windows/fileformat/winrar_name_spoofing.

AI-analyzed exploit summary This Metasploit module exploits a filename spoofing vulnerability in WinRAR (CVE-2014-125119) by creating a ZIP file with mismatched filenames in the central directory and local file header. It embeds a payload executable with a spoofed name to deceive users into executing arbitrary code.

A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.