{
  "cveId": "CVE-2026-14191",
  "url": "https://patchblox.com/security/cve/CVE-2026-14191",
  "summary": "CVE-2026-14191 is fixed in 3 products on 2 platforms, first by WinRAR 7.23.0, released June 27, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader",
  "description": "An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file\u0027s own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header\u0027s RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example \u0027unrar t x.part1.rev\u0027, WinRAR \u0027Repair archive\u0027, or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.",
  "published": "2026-07-01T04:16:58Z",
  "severity": "Important",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "cwe": "Out-of-bounds Write",
  "epss": 0.00437,
  "epssPercentile": 0.38248,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14191",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "WinRAR",
      "fixedVersion": "7.23.0",
      "fix": "WinRAR 7.23.0",
      "url": "https://patchblox.com/security/fix/windows-app/rarlab.winrar-7.23.0",
      "released": "2026-06-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rar",
      "release": "Debian 14",
      "fixedVersion": "2:7.23-1",
      "fix": "DEBIAN-CVE-2026-14191",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-14191",
      "released": "2026-07-01T04:16:58Z"
    },
    {
      "platform": "linux",
      "product": "unrar-nonfree",
      "release": "Debian 14",
      "fixedVersion": "1:7.2.7-1",
      "fix": "DEBIAN-CVE-2026-14191",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-14191",
      "released": "2026-07-01T04:16:58Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}