# CVE-2026-14191: WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

CVE-2026-14191 is fixed in 3 products on 2 platforms, first by WinRAR 7.23.0, released June 27, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-14191
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0044
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 1, 2026
- Weakness: Out-of-bounds Write
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14191

## Description

An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | WinRAR | 7.23.0 | [WinRAR 7.23.0](https://patchblox.com/security/data/fix/windows-app/rarlab.winrar-7.23.0.md) | Jun 27, 2026 |
| Linux | rar Debian 14 | 2:7.23-1 | [DEBIAN-CVE-2026-14191](https://patchblox.com/security/data/fix/linux/debian-cve-2026-14191.md) | Jul 1, 2026 |
| Linux | unrar-nonfree Debian 14 | 1:7.2.7-1 | [DEBIAN-CVE-2026-14191](https://patchblox.com/security/data/fix/linux/debian-cve-2026-14191.md) | Jul 1, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.