CVE-2018-20250

What is WinRAR?

WinRAR is one of the most widely used archive utilities on Windows, installed on hundreds of millions of machines worldwide for opening and creating ZIP, RAR, ACE, and other compressed archive formats. Because it's so ubiquitous and is often used to open files received from untrusted sources (email attachments, downloads), a flaw that triggers on simple extraction — with no further action required from the victim — is an extremely attractive delivery mechanism for malware.

Overview

CVE-2018-20250 is an absolute path traversal vulnerability rooted in UNACEV2.dll, a third-party, closed-source library that WinRAR bundled for decades to handle the legacy ACE archive format. The library fails to validate the destination path specified for extracted files, allowing a maliciously crafted ACE archive to instruct WinRAR to extract a file to an arbitrary, attacker-chosen location on disk — such as a user's Startup folder — rather than the folder the user selected for extraction. Since files placed in the Startup folder run automatically the next time the victim logs in, this turns simple archive extraction into full remote code execution.

Technical Details

The weakness is classified under CWE-36 (absolute path traversal): the ACE format extraction logic in UNACEV2.dll trusts a path string embedded in the archive itself and does not restrict it to the intended extraction directory, allowing it to escape via an absolute path. Because UNACEV2.dll had not been updated in roughly 19 years and its original source code was unavailable to WinRAR's developers, RARLAB could not simply patch the flaw — instead, WinRAR 5.70 dropped ACE format support entirely, decompiling and rewriting the format handling to eliminate the vulnerable code rather than fix it in place. Exploitation requires the victim to open (extract) a malicious archive — no other privileges or complex conditions are needed.

Discovery

The vulnerability was discovered and publicly disclosed by Check Point Research (credited to researcher Nadav Grossman), published alongside three related CVEs covering different code paths in the same vulnerable library, under the title "Extracting Code Execution From WinRAR."

Exploitation Context

Following public disclosure, this bug was rapidly weaponized: security researchers and threat actors alike published proof-of-concept ACE archives, and multiple malware and ransomware campaigns adopted crafted ACE files as an infection vector, since a huge installed base of WinRAR users had not yet updated past the vulnerable version at the time. The ransomwareUse: true marker on this entry reflects that pattern of adoption by ransomware and commodity malware operators using booby-trapped archives as an initial-access technique. CISA's KEV listing confirms this activity has continued to be observed against unpatched installations.

Remediation

1. Update WinRAR to version 5.70 or later, which removes the vulnerable ACE handling entirely — simply patching is not possible for older, ACE-supporting versions.
2. Treat any ACE-format archive from an untrusted or unexpected source with suspicion, and avoid extracting archives from unknown senders regardless of format.
3. Deploy email/gateway filtering that flags or blocks ACE archive attachments, particularly for organizations that have not yet completed the WinRAR upgrade.
4. Audit Startup folders and common persistence locations (registry Run keys, scheduled tasks) on systems where WinRAR extraction of untrusted archives may have occurred prior to patching.
5. Consider standardizing on modern archive tools with active update cadences, and remove standalone WinRAR installations that are not centrally managed or patched.