Nearly a year after it was first caught being weaponized in the wild, the WinRAR vulnerability tracked as CVE-2025-8088 has become one of the most durable weapons in the modern attacker’s toolkit. As of June 2026, Google’s Threat Intelligence Group reports that exploitation of this WinRAR zero-day by both state-sponsored and financially motivated groups “remains widespread and ongoing” – a rare status for a flaw that was patched back in July 2025. The reason is uncomfortably simple: WinRAR does not update itself, and RARLAB claims roughly 500 million people use it. Half a billion installations, no automatic patching, and a bug that turns a routine double-click on an archive into silent code execution.
This is not a story about a new bug. It is a story about how a single, well-understood winrar vulnerability keeps working month after month because the software’s own distribution model guarantees a long tail of unpatched machines. Below, we break down exactly how CVE-2025-8088 works, which threat actors are exploiting it – from the espionage-and-ransom crew RomCom to Russia’s FSB-linked Gamaredon group – why the fix has been so slow to land, and what the archive-file attack wave means for enterprises heading into the second half of 2026.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2025-8088? The WinRAR Zero-Day Explained
CVE-2025-8088 is a path-traversal vulnerability in the Windows build of WinRAR, the file-compression utility that Eugene Roshal first shipped in 1995 and that win.rar GmbH (RARLAB) still maintains today. The U.S. National Vulnerability Database assigns it a CVSS v3 base score of 8.8 (High), placing it just below the “Critical” threshold; some trackers score it 8.4. Either way, it sits in the danger zone, and its inclusion in CISA’s Known Exploited Vulnerabilities catalog removed any doubt that this was theoretical.
The flaw affects every Windows version of WinRAR up to and including 7.12, along with the command-line UnRAR utility, the UnRAR.dll library, and the portable UnRAR source code. It was discovered being exploited as a genuine zero-day – meaning attackers were using it before any patch existed. ESET researchers Anton Cherepanov, Peter Košinár, and Peter Strýček identified the in-the-wild abuse and reported it to RARLAB. The developer moved quickly by its own standards, shipping the fix in WinRAR 7.13 on July 30, 2025, roughly a week and a half after the first observed attacks on July 18.
What makes CVE-2025-8088 particularly dangerous is that it requires almost no sophistication from the victim. There is no macro to enable, no second-stage download to approve, no obvious warning dialog. A user simply extracts what looks like an ordinary RAR archive, sees the expected harmless file appear, and never learns that a second, hidden payload was written somewhere else on disk entirely. That gap between what the user sees and what actually happens is the whole exploit.
How the WinRAR Exploit Works: Alternate Data Streams and the Startup Folder
The mechanics of this winrar exploit combine two old Windows concepts: directory traversal and NTFS Alternate Data Streams (ADS). Alternate Data Streams are a legitimate NTFS feature that lets a file carry hidden, secondary streams of data alongside its main content. WinRAR’s extraction routines failed to properly sanitize path components inside archive entries, so an attacker could smuggle a malicious stream whose “name” was actually a relative filesystem path studded with traversal sequences.
In practice, a crafted archive contains a benign-looking document plus a hidden ADS whose path climbs out of the intended extraction directory and lands in a location Windows automatically trusts. A representative traversal path looks like this:
..\..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.lnkAccording to ESET’s technical write-up, the observed campaigns dropped a malicious DLL into the %TEMP% directory and planted a malicious LNK shortcut file inside the Windows Startup folder. Because anything in the Startup folder executes automatically at the next logon, the attacker achieves persistence without any further interaction. The victim reboots, the shortcut fires, the DLL loads, and the machine is compromised – all from the act of opening one archive. The extracted “real” file displays normally the entire time, which is why the technique is so effective at evading suspicion.
The delivery vehicle was equally mundane. Attackers sent spearphishing emails carrying RAR attachments disguised as job applications and CVs, with subject lines such as “Experienced Web3 Developer – CV Attached for Consideration” and filenames like Eli_Rosenfeld_CV2 - Copy (10).rar and JobDocs_July2025.rar. Recruiters and hiring managers, whose jobs revolve around opening unsolicited resumes from strangers, were an ideal target set.
Who Is Exploiting CVE-2025-8088: RomCom, Paper Werewolf and Beyond
The first group tied to this WinRAR zero-day is RomCom – also tracked as Storm-0978, Tropical Scorpius, and UNC2596 – a Russia-aligned actor unusual for blending financially motivated cybercrime with state-style espionage. Per ESET and corroborating reports from Help Net Security, RomCom used CVE-2025-8088 between July 18 and 21, 2025, against financial, manufacturing, defense, and logistics companies across Europe and Canada. Their intrusions delivered three separate execution chains: a Mythic agent, a SnipBot variant, and the RustyClaw/MeltingClaw downloader family.
A second actor, Paper Werewolf (also called GOFFEE), was observed exploiting the same class of flaw against Russian organizations. Before pivoting to CVE-2025-8088, Paper Werewolf had already been abusing the closely related CVE-2025-6218 – a traditional path-traversal bug that RARLAB patched in WinRAR 7.12 beta 1 on June 10, 2025. The near-simultaneous discovery of two extraction-path bugs in the same window underscores how much attacker attention WinRAR’s parsing code was drawing.
Crucially, exploitation did not stop when the patch shipped. Google’s Threat Intelligence Group (GTIG) confirmed in January 2026 that a diverse set of threat actors – spanning both nation-state and criminal ecosystems – continued to weaponize CVE-2025-8088 well into 2026. That persistence is the entire market signal: attackers keep investing in an exploit chain precisely because they know the vulnerable population never fully disappears.
Gamaredon and the June 2026 Escalation Against Ukraine
The most geopolitically charged chapter of the WinRAR story runs through Gamaredon, one of the most relentless Russian cyber-espionage crews on record. Ukraine’s Security Service (SSU) publicly attributed the group to the Russian Federal Security Service (FSB) – specifically its Center 18 information-security directorate operating out of occupied Crimea – on November 4, 2021, even naming five FSB officers. By the SSU’s own count at the time, Gamaredon had carried out more than 5,000 cyberattacks against over 1,500 Ukrainian government systems.
Active since at least 2013, Gamaredon (also called Armageddon, Primitive Bear, ACTINIUM, Aqua Blizzard, Shuckworm, and Trident Ursa) has spent the war years fixated almost entirely on Ukrainian government, military, and critical-infrastructure targets. Palo Alto Networks’ Unit 42 has mapped more than 700 malicious domains, 215 IP addresses, and over 100 malware samples across its infrastructure. In 2024, ESET documented the group introducing six new PowerShell- and VBScript-based tools and hiding nearly its entire command-and-control network behind Cloudflare tunnels. Gamaredon is also known for aggressive USB-based worm propagation, a tactic that pairs naturally with malicious archive files spread across air-gapped and semi-isolated networks.
The group remains highly active in 2026. On June 1, 2026, threat-intelligence firm Sekoia published the first installment of its “FSB’s Matryoshka” research series, detailing fresh Gamaredon campaigns built around nested backdoors it dubs GammaPhish and GammaWorm, and confirming the intrusion set was “still actively operating at the time of this publication.” For defenders, the takeaway is blunt: archive-borne infection chains are not a 2025 relic. They are a live, evolving component of Russia’s cyber operations against Ukraine and, increasingly, NATO partners.
CVE-2025-8088 at a Glance: Key Technical Facts
The table below consolidates the verified technical parameters of this winrar vulnerability for quick reference by IT and security teams.
| Attribute | Detail |
|---|---|
| CVE ID | CVE-2025-8088 |
| Vulnerability type | Path traversal via NTFS Alternate Data Streams (ADS) |
| CVSS v3 score | 8.8 High (some trackers rate 8.4) |
| Affected software | WinRAR for Windows ≤ 7.12, UnRAR.dll, UnRAR CLI, portable UnRAR source |
| Fixed version | WinRAR 7.13 (released July 30, 2025) |
| Discovered by | ESET (A. Cherepanov, P. Košinár, P. Strýček) |
| First in-the-wild exploitation | July 18, 2025 |
| Known exploiting actors | RomCom, Paper Werewolf, additional groups (per Google GTIG) |
| Impact | Arbitrary file write → persistence → remote code execution |
| CISA KEV status | Listed as Known Exploited Vulnerability |
Why 500 Million WinRAR Users Remain Exposed
Here is the structural problem that turns a patched bug into an evergreen threat: WinRAR has no automatic update mechanism. Unlike browsers, operating systems, and most modern software, WinRAR will not silently pull down a fix in the background. Every one of its roughly 500 million users must manually visit rarlab.com, download the new installer, and run it. The vast majority never will, because the software keeps functioning indefinitely after its trial “expires” – it simply nags – so there is no forcing function to prompt an update.
The 500-million figure is RARLAB’s own long-standing claim, cited across a decade of security reporting from Computerworld to Help Net Security. Even if only a fraction of those installs are internet-connected Windows machines that regularly open archives from external sources, the vulnerable pool is enormous. Qualys warned in its September 2025 analysis that CVE-2025-8088 “leaves millions of Windows systems exposed,” describing it as an enterprise-scale risk rather than a consumer nuisance.
This is why the attacker economics are so favorable. When a browser zero-day is patched, auto-update collapses the vulnerable population within days. When a WinRAR zero-day is patched, the vulnerable population decays over months or years, one manual download at a time. An exploit that would be dead on arrival against Chrome can keep paying dividends against WinRAR long after the fix is public – exactly the pattern GTIG documented into 2026.
A History of WinRAR Vulnerabilities: This Is a Pattern, Not an Accident
CVE-2025-8088 is the latest entry in a long ledger of WinRAR flaws that share a striking common thread: attackers repeatedly abuse the extraction process to drop executables into the Windows Startup folder. In 2019, Check Point disclosed CVE-2018-20250, a path-traversal bug in the ancient UNACEV2.dll library WinRAR used to handle ACE archives. That library had not been updated since 2005 and RARLAB lacked its source code, so the vendor’s fix was to drop ACE support entirely in WinRAR 5.70. More than 100 distinct malware samples were later observed exploiting that flaw.
Then came CVE-2023-38831, arguably the most consequential WinRAR bug before this one. RomCom and multiple Russian state APT clusters used it as a zero-day throughout 2023, notably targeting cryptocurrency traders and online trading forums by hiding a malicious script alongside a decoy document inside a booby-trapped archive. The 2025 pair – CVE-2025-6218 (patched in 7.12 beta 1) and CVE-2025-8088 (patched in 7.13) – extended the streak into the current threat cycle. The historical record makes the analytical conclusion unavoidable: WinRAR’s archive-parsing surface is a recurring, high-value target, and the “open an archive, own the machine” pattern is now a well-worn attacker playbook.
| CVE | Year | Root cause | Notable abuse | Fix |
|---|---|---|---|---|
| CVE-2018-20250 | 2019 | ACE path traversal (UNACEV2.dll) | 100+ malware samples; Startup-folder drops | ACE support removed (WinRAR 5.70) |
| CVE-2023-38831 | 2023 | Archive spoofing / hidden payload | RomCom + Russian APTs; crypto traders | WinRAR 6.23 |
| CVE-2025-6218 | 2025 | Directory traversal on extraction | Paper Werewolf activity | WinRAR 7.12 beta 1 |
| CVE-2025-8088 | 2025 | Path traversal via NTFS ADS | RomCom, Paper Werewolf, others | WinRAR 7.13 |
Market Impact: Archive Files Become the Attacker’s Favorite Envelope
The strategic significance of the winrar vulnerability wave extends well beyond one utility. As Microsoft, browser vendors, and email gateways have hardened the traditional infection routes – macro-enabled Office documents, ISO images, one-click links – attackers have migrated to compressed archives as the delivery envelope of choice. Archives are trusted, ubiquitous in business workflows, and frequently sail past perimeter filters that were tuned for other file types. A malicious RAR that writes a hidden LNK to the Startup folder generates none of the telemetry an EDR product expects from a classic malicious-document chain.
For enterprises, the blast radius is defined less by the exploit’s technical elegance than by inventory blind spots. WinRAR is rarely tracked in software asset-management systems, almost never centrally managed, and commonly installed by individual employees years ago and forgotten. Security teams that can patch Windows across 20,000 endpoints in a maintenance window often have no mechanism at all to force-update a third-party archiver sitting on a fraction of those same machines. The same operational gap that makes CVE-2025-8088 attractive to Gamaredon and RomCom makes it a governance headache for every CISO who assumes “we patch Patch Tuesday” equals “we are covered.”
The competitive dimension matters too. Rival archivers such as 7-Zip and the built-in Windows extraction handler have their own histories of extraction bugs, so ripping out WinRAR is not a silver bullet. But 7-Zip’s open-source scrutiny and the Windows handler’s inclusion in Microsoft’s centrally deployed update pipeline both change the patch-velocity math in defenders’ favor – a genuine differentiator when the core risk is not the bug itself but how slowly the fix propagates.
The 2026 Threat Backdrop: Intrusions and Ransomware Keep Climbing
CVE-2025-8088 is not being exploited in a vacuum. Verizon’s 2026 Data Breach Investigations Report found that system intrusions now account for 61% of breaches, that ransomware was present in roughly 48% of all breaches, and – a rare bright spot – that 69% of victim organizations did not pay a ransom. Check Point Research, meanwhile, reported that ransomware activity surged 48% in May 2026, with the education sector absorbing more weekly attacks per organization than any other industry.
Against that backdrop, a reliable, low-cost initial-access technique like a WinRAR archive exploit is exactly what both espionage crews and ransomware affiliates want. Initial access is the scarce, expensive commodity in the modern attack chain; a bug that converts a routine email attachment into code execution and persistence in a single step is worth cultivating for as long as it works. The continued exploitation GTIG flagged in early 2026 is best read not as attacker laziness but as a rational response to a target population that refuses to shrink.
Readers tracking the broader breach landscape can see the same dynamics in our coverage of the FortiBleed firewall breach, the ShinyHunters Oracle zero-day campaign, and the Foxconn ransomware attack – each a case study in how a single unpatched entry point cascades into an enterprise-wide compromise.
How to Protect Yourself: Update WinRAR and Harden Extraction
The single most important action is also the simplest: update WinRAR to 7.13 or later on every Windows machine that has it installed. Because there is no auto-update, this must be done manually or pushed through a software-deployment tool. The defensive checklist below reflects guidance consolidated from ESET, Qualys, and CISA’s KEV listing.
- Patch now: Download the latest WinRAR from rarlab.com and confirm the installed build is 7.13 or newer. Remember that UnRAR.dll bundled inside other applications may also need updating.
- Inventory it: Sweep endpoints for any WinRAR or UnRAR install using your EDR or asset-management tooling; you cannot patch what you do not know exists.
- Treat archives as untrusted: Do not extract RAR, ZIP, or 7z files from unsolicited emails – particularly unexpected “CVs,” invoices, or job applications.
- Monitor the Startup folder: Alert on new LNK and executable files written to per-user and system-wide Startup directories, the persistence sink these exploits favor.
- Watch %TEMP% for DLLs: Flag unexpected DLL writes to temporary directories followed by execution, a hallmark of the observed CVE-2025-8088 chains.
- Consider alternatives: Where feasible, standardize on a centrally patched extraction tool so future archive bugs propagate fixes faster.
Organizations that want deeper detection coverage can layer on an open-source SIEM – see our Wazuh SIEM setup guide – to centralize Startup-folder and process-creation telemetry, and should pair that with strong endpoint protection, as covered in our antivirus comparison. Knowing how to update WinRAR is the fix; knowing when someone opened a malicious archive anyway is the safety net.
What Comes Next: 5 Predictions for Archive-Based Threats in 2026
Based on the trajectory of CVE-2025-8088 and the historical WinRAR pattern, several developments look likely through the remainder of 2026:
- The vulnerable tail persists. With no auto-update, meaningful numbers of unpatched WinRAR installs will still exist at year-end, and opportunistic exploitation of CVE-2025-8088 will continue rather than fade.
- Ransomware affiliates adopt the technique. Expect archive-based initial access, proven by RomCom and Gamaredon, to migrate further into commodity ransomware operations chasing cheap, reliable entry.
- More extraction-parser bugs surface. Attacker and researcher attention on WinRAR’s parsing code has been rewarded twice in 2025; additional path-traversal or ADS-class findings in archivers are probable.
- Enterprises formalize archiver governance. Third-party utilities like WinRAR will increasingly be pulled into asset inventories and forced-update policies as CISOs close the patch-velocity gap.
- State actors keep leaning in. Gamaredon and peers will continue folding malicious archives into USB-spreading and spearphishing chains against Ukraine and NATO partners, as Sekoia’s June 2026 research already signals.
Frequently Asked Questions
Is CVE-2025-8088 still dangerous in 2026 if it was patched in 2025?
Yes. The patch exists in WinRAR 7.13, but because WinRAR has no automatic updater, huge numbers of installs remain on vulnerable versions (7.12 and earlier). Google’s Threat Intelligence Group confirmed in January 2026 that exploitation by multiple threat actors was still widespread and ongoing, which is why the flaw remains a live risk.
Which WinRAR version fixes the vulnerability?
WinRAR 7.13, released on July 30, 2025, patches CVE-2025-8088. Any Windows build of WinRAR up to and including 7.12 is affected, along with the UnRAR command-line tool, UnRAR.dll, and the portable UnRAR source. Update to 7.13 or later from rarlab.com.
How do I update WinRAR safely?
Download the latest installer directly from the official rarlab.com download page and run it over your existing installation; it preserves your settings. Avoid third-party download mirrors. If your organization bundles UnRAR.dll inside other software, update those applications too, since the vulnerable library can travel independently of the main WinRAR app.
What is the CVSS score of CVE-2025-8088?
The National Vulnerability Database assigns a CVSS v3 base score of 8.8 (High), though some vulnerability trackers rate it 8.4. It is also listed in CISA’s Known Exploited Vulnerabilities catalog, reflecting confirmed in-the-wild exploitation.
Who is behind the WinRAR zero-day attacks?
The earliest confirmed exploitation was by RomCom (Storm-0978 / UNC2596), a Russia-aligned espionage-and-cybercrime group, followed by Paper Werewolf (GOFFEE). Additional state-sponsored and financially motivated actors have since adopted the technique, and Russia’s FSB-linked Gamaredon group remains a prolific user of malicious archives against Ukrainian targets.
Can antivirus alone stop this WinRAR exploit?
Not reliably. Because the exploit abuses a legitimate NTFS feature (Alternate Data Streams) and drops files via normal extraction, signature-based detection can miss the initial write. The durable fix is patching WinRAR to 7.13+, backed by behavioral monitoring of the Startup folder and %TEMP% directory and by treating archives from unknown senders as untrusted.
Does this affect Mac or Linux users?
CVE-2025-8088 specifically affects the Windows version of WinRAR and Windows builds of UnRAR, because the exploit relies on NTFS Alternate Data Streams and the Windows Startup folder for persistence. Linux and macOS extraction tools use different filesystems and mechanisms, though users on those platforms should still keep archive utilities current as a general practice.
