← Back to Security

WinRAR Vulnerability Update: Gorbag Exploits CVE-2025-8088

InvisHosting Security November 5, 2026 6 min read
winrar cve-2025-8088 malware phishing windows

If you use WinRAR on Windows, update it by hand to the latest version from the official site. Versions 7.12 and older are vulnerable to CVE-2025-8088, a flaw patched in July 2025. According to a report ESET published on November 3, 2026, a Russia-aligned group called Gorbag is still exploiting it. The attacks target Ukrainian organizations, but any outdated WinRAR install can be fooled by a booby-trapped RAR file, and WinRAR does not update itself.

What happened

On November 3, 2026, ESET published research on a group it tracks as Gorbag. The details below come from ESET's report as summarized by Cyber Security News on November 4, 2026.

  • Gorbag has been active since at least February 2025. It targets government agencies, law enforcement and justice institutions in Ukraine.
  • Throughout 2025, it mostly sent phishing emails with malicious Excel attachments that needed macros to run. At least one email came from a real, compromised Ukrainian local government mailbox.
  • In early 2026, the group switched to malicious RAR archives that exploit CVE-2025-8088. Extracting one shows a decoy PDF while quietly placing a shortcut in the Windows Startup folder.

What the BeautyStealer malware takes

The main payload, BeautyStealer, collects:

  • Saved passwords, cookies and browser state from Chrome, Edge, Opera and Firefox
  • OpenVPN configuration files
  • Files from Desktop, Documents and Downloads, removable media and mapped network drives
  • KeePass databases, Java KeyStore files, Remote Desktop configurations and certificate containers

The stolen data is sent out through Telegram's API or a custom server, and the malware then tries to delete itself.

How CVE-2025-8088 works, in plain English

ESET discovered this flaw being exploited as a zero-day on July 18, 2025. ESET describes it as a path traversal vulnerability that uses Windows alternate data streams. In practice, an archive can hide extra files that get silently written to other places on your PC when you extract it, such as the Startup folder, so malware runs every time you log in.

The archive is built to look as if it contains only one harmless file. WinRAR does show warnings, but the attackers pad the archive with dummy entries, so the suspicious paths only appear if you scroll down the warning list. "It only showed me a PDF" is not a sign that nothing happened.

Why a bug patched in July 2025 still works in 2026

WinRAR 7.13, released on July 30, 2025, fixed the flaw. But as Malwarebytes noted in July 2026, WinRAR still has no automatic updates. Many PCs keep running an old copy for years without anyone noticing.

Who is affected

  • WinRAR for Windows, version 7.12 and older
  • The Windows versions of the RAR command-line utilities, UnRAR.dll and the portable UnRAR source code
  • Other software that relies on the public Windows UnRAR.dll or its source code, especially if its dependencies haven't been updated

Gorbag's reported targets are Ukrainian organizations. The flaw itself works against anyone with an outdated install.

Mac, Linux or Android? ESET's advisory names the Windows versions of WinRAR, its command-line utilities and UnRAR.dll, plus the portable UnRAR source code. It doesn't say anything beyond that.

What you should do

  1. Check your version. Open WinRAR and go to Help > About WinRAR. If it says 7.12 or lower, you are vulnerable. Even if you're on 7.13 or later, get the newest release: Malwarebytes reported a separate, later WinRAR flaw fixed in mid-2026.
  2. Download only from the official site. Use the WinRAR download page, not a mirror or a link from an email. The What's new page lists the current version.
  3. Pick the right build. Choose 64-bit, 32-bit or ARM to match your PC. Windows shows this under Settings > System > About, next to "System type".
  4. Install over the old version, then open Help > About WinRAR again to confirm the new number.
  5. Uninstall WinRAR if you don't need it. Malwarebytes advises treating it as optional software.
  6. Update other archive tools that open RAR files, in case they bundle an old UnRAR.dll.

What to do if you already extracted a suspicious archive

  1. Open your Startup folder (press Win+R and type shell:startup) and look for shortcuts you don't recognize. Don't open them; let your security software handle them.
  2. Run a full scan with your antivirus.
  3. From a different, clean device, change passwords saved in your browsers and sign out of all active sessions, since stolen cookies can keep attackers logged in.
  4. Change your VPN credentials and the master password of any password manager database, such as KeePass.
  5. Assume files in Desktop, Documents, Downloads and connected drives may have been copied. At work, tell your IT or security team right away.

Updating closes the hole, but it doesn't undo what was already taken.

How to stay safe with RAR files

  • Don't open unsolicited attachments unless you can confirm the sender through a separate channel, such as a phone call. A message from a known address isn't proof: Gorbag used a real, compromised mailbox.
  • Be wary of archives that seem to hold a single document. Our guide on how to check if a file is safe before you open it walks through scanning and other checks.

Tips for small teams that share archives

  • Agree in advance how files will be sent, so an unexpected attachment stands out.
  • Confirm surprise archives with the sender by chat or phone before extracting.
  • Make keeping everyone's extractor up to date part of routine maintenance.

If you share files through InvisHosting, every upload is scanned with VirusTotal and executables and other dangerous file types are blocked. That's a safety net, not a guarantee; read how we defend against malware uploads. Files aren't end-to-end encrypted, so encrypt sensitive archives before uploading. Our guide to sharing large files for free covers options.

FAQ

Is WinRAR safe to use in 2026?

An up-to-date copy from the official site is the safe option. Old versions are the problem, because WinRAR won't update itself.

Can extracting a RAR file infect my computer?

With a vulnerable version, yes. CVE-2025-8088 lets an archive drop hidden files during extraction without you opening anything else.

Which WinRAR version fixes CVE-2025-8088?

WinRAR 7.13, released July 30, 2025. Install the latest version rather than stopping there.

Is there a newer WinRAR vulnerability?

Malwarebytes reported a separate flaw fixed in mid-2026. Installing the latest release from the official site covers both.

Sources

This article was written with AI assistance from the sources listed above and checked automatically against them.

← All Security Briefings