CVE-2019-25677

MEDIUM

WinRAR 5.61 Denial of Service via Malformed Language File

Title source: cna

Description

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.

Exploits (1)

exploitdb WORKING POC
by Kağan Çapar · perldoswindows
https://www.exploit-db.com/exploits/46432

References (3)

Scores

CVSS v3 6.2
EPSS 0.0001
EPSS Percentile 2.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-379
Status published
Products (2)
rarlab/winrar < 5.61
Win-Rar/WinRAR 5.61 32 Bit
Published Apr 05, 2026
Tracked Since Apr 06, 2026