CVE-2014-125119
WinRAR < 5.00 Filename Spoofing RCE
- State
- Published
- Severity
- 8.4 High
- Published
- Jul 25, 2025
- Updated
- May 14, 2026
- Reserved
- Jul 24, 2025
Description
A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
WinRARRARLab |
|
References
- https://www.rarlab.com/vuln_zip_spoofing_4.20.htmlvendor-advisory
- https://an7isec.blogspot.com/2014/03/winrar-file-extension-spoofing-0day.htmltechnical-descriptionexploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/winrar_name_spoofing.rbexploit
- https://web.archive.org/web/20141111142204/https://www.intelcrawler.com/report_2603.pdftechnical-description
- https://web.archive.org/web/20140625054244/http://intelcrawler.com/news-15technical-descriptionmedia-coverage
- https://www.vulncheck.com/advisories/winrar-filename-spoofing-rcethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.