WinRAR UNACEV2.dll Path Traversal and Remote Code Execution Vulnerability (CVE-2018-20250)
Executive & SecOps Summary
SECOPS ASSESSMENTWinRAR versions 5.61 and prior (including UNACEV2.dll library)
Attackers can bypass extraction path restrictions to drop malicious executables into arbitrary directories, such as the Windows Startup folder, leading to system compromise [1, 2, https://research.checkpoint.com/extracting-code-execution-from-winrar/]
Immediately upgrade WinRAR to version 5.70 or later, or manually delete the vulnerable UNACEV2.dll file [1, https://research.checkpoint.com/extracting-code-execution-from-winrar/]
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
RARLAB has completely dropped support for the ACE format and removed UNACEV2.dll starting from WinRAR version 5.70 [1, https://research.checkpoint.com/extracting-code-execution-from-winrar/]. Upgrade to the latest version immediately.
# Upgrade WinRAR to the latest version using winget package manager
winget upgrade --id RARLab.WinRAR2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, delete the vulnerable 'unacev2.dll' file from the WinRAR installation directory to disable ACE archive extraction [1, https://research.checkpoint.com/extracting-code-execution-from-winrar/].
# PowerShell script to locate and delete the vulnerable unacev2.dll
$winrarPath = '${env:ProgramFiles}\WinRAR\unacev2.dll'
if (Test-Path $winrarPath) {
Remove-Item -Path $winrarPath -Force
Write-Host 'unacev2.dll successfully removed. Vulnerability mitigated.' -ForegroundColor Green
} else {
Write-Host 'unacev2.dll not found or already removed.' -ForegroundColor Yellow
}3. Log Audit & IoC Verification Commands
Use the following commands to audit installed WinRAR versions and inspect the Windows Startup directory for unauthorized executables.
# 1. Check installed WinRAR version via Registry
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName -like '*WinRAR*' } |
Select-Object DisplayName, DisplayVersion
# 2. Inspect Windows Startup folder for suspicious executable files
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Filter *.exeBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in 'UNACEV2.dll', a dynamic link library used by WinRAR to unpack ACE archive formats, due to insufficient validation of input filenames. UNACEV2.dll had not been updated since 2005 and lacked modern exploit mitigation techniques. When parsing a crafted ACE archive, the library fails to properly sanitize the filename field, allowing directory traversal sequences to treat the destination path as an absolute path.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts an ACE archive where the internal file header contains a manipulated filename path, such as 'C:\C:C:../AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malicious.exe' [2, https://research.checkpoint.com/extracting-code-execution-from-winrar/]. When a victim extracts this archive using an affected version of WinRAR, the path traversal vulnerability causes the application to ignore the user-specified extraction directory and write the payload directly into the Windows Startup folder [2, https://research.checkpoint.com/extracting-code-execution-from-winrar/]. The dropped malware is then executed automatically upon the next system reboot [https://research.checkpoint.com/extracting-code-execution-from-winrar/].
3. Infrastructure & Business Impact
As a highly critical vulnerability listed in the CISA KEV catalog, this flaw has been actively exploited by advanced persistent threat (APT) actors via spear-phishing campaigns [https://research.checkpoint.com/extracting-code-execution-from-winrar/]. Successful exploitation grants the attacker initial access to endpoint devices, which can lead to lateral movement, ransomware deployment, and sensitive data exfiltration across the corporate network.
Official Vendor Advisories & References
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
Frequently Asked SecOps Questions (CVE-2018-20250)
FAQQ1. How critical is CVE-2018-20250 and is it actively exploited in the wild?
CVE-2018-20250 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 96.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2018-20250?
Primary impacted vendors include rarlab across winrar. Scope summary: All WinRAR versions prior to and including 5.61 on Windows environments
Q3. What temporary mitigations or workarounds exist for CVE-2018-20250 before patching?
[Mitigation] Immediately upgrade WinRAR to version 5.70 or later, or manually delete the vulnerable UNACEV2.dll file [1, https://research.checkpoint.com/extracting-code-execution-from-winrar/] Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2018-20250
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (rarlab)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.