Answer in brief
CVE-2026-14191 records a High severity (CVSS 7.8) vulnerability in WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader. The current sources do not mark it as known exploited. The current feed maps RARLAB/RAR (generic), RARLAB/UnRAR (generic), RARLAB/UnRAR (generic), RARLAB/UnRAR.dll (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps RARLAB/RAR (generic), RARLAB/UnRAR (generic), RARLAB/UnRAR (generic), RARLAB/UnRAR.dll (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| RARLAB/RARgeneric | >=0 <7.23 | 7.23 |
| RARLAB/UnRARgeneric | 0 | Not reported |
| RARLAB/UnRARgeneric | >=0 <=7.21 | Not reported |
| RARLAB/UnRAR.dllgeneric | >=0 <7.23 | 7.23 |
| RARLAB/WinRARgeneric | >=0 <7.23 | 7.23 |
Published upstream
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 1, 2026
An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.
Quoted source text, attributed separately from HOL analysis.