Google Warns of WinRAR Vulnerability Exploited to Gain Control Over Windows System
WinRAR, a widely used file compression tool for Windows, has been found to contain a critical security vulnerability identified as CVE-2025-8088. This flaw enables attackers to insert malicious files into sensitive system directories without user…
WinRAR, a widely used file compression tool for Windows, has been found to contain a critical security vulnerability identified as CVE-2025-8088. This flaw enables attackers to insert malicious files into sensitive system directories without user awareness, effectively gaining control of affected Windows machines.
First identified in July 2025, this vulnerability remains a significant threat despite a patch being available since Jul 30, 2025. It has been exploited by various attacker groups, including government-backed operations and financially motivated criminals, to deliver malware and steal credentials.
The attack method involves creating specially crafted RAR archive files that exploit a path traversal weakness, allowing files to be written to arbitrary locations on victim computers. The vulnerability is frequently used to place malicious files into the Windows Startup folder, ensuring malware executes automatically upon system login.
Google Cloud researchers have documented widespread exploitation of this vulnerability across multiple campaigns, targeting sectors such as military, government, technology, hospitality, and banking. Attackers leverage this flaw to establish persistent access to compromised systems.
WinRAR, a widely used file compression tool for Windows, has been found to contain a critical security vulnerability identified as CVE-2025-8088.
To mitigate risks, it is recommended that organizations and individual users update to WinRAR version 7.13 or later. Google advises using Safe Browsing and Gmail security features to block files containing the exploit. Immediate patching is crucial, as attackers continue to exploit known vulnerabilities long after fixes are available.
The exploitation technique revolves around manipulating Alternate Data Streams (ADS), a Windows file system feature that attackers use to conceal malicious content. When victims open a compromised RAR archive, they may see an innocuous document while malicious files are silently extracted to critical system locations.
For instance, a malicious archive might contain a file named "innocuous.pdf:malicious.lnk" with a path crafted to write directly to the Startup folder. This ensures the malicious file runs automatically when the user logs in, granting attackers persistent control.
Based on reporting by Cyber Security News.