How severe is CVE-2025-31334?

CVE-2025-31334 has a CVSS 3.x base score of 6.8, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-31334 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (65th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-31334?

CVE-2025-31334 affects Rarlab Winrar. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-31334?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-31334 have an EU (EUVD) identifier?

Yes. CVE-2025-31334 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-9627.

When was CVE-2025-31334 published?

CVE-2025-31334 was published on 2025-04-03 and last updated on 2026-06-17.

CVE-2025-31334

CVE-2025-31334 is a medium-severity vulnerability in Rarlab Winrar with a CVSS 3.x base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-356.

Key facts

Severity: Medium (CVSS 3.x base score 6.8)
EPSS exploit prediction: 1% (65th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-9627
Weakness: CWE-356
Affected product: Rarlab Winrar
Published: 2025-04-03
Last modified: 2026-06-17

Description

Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.

Frequently asked questions

What is CVE-2025-31334?: Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR versions prior to 7.11. If a symbolic link specially crafted by an attacker is opened on the affected product, arbitrary code may be executed.
How severe is CVE-2025-31334?: CVE-2025-31334 has a CVSS 3.x base score of 6.8, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-31334 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (65th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-31334?: CVE-2025-31334 affects Rarlab Winrar. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-31334?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-31334 have an EU (EUVD) identifier?: Yes. CVE-2025-31334 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-9627.
When was CVE-2025-31334 published?: CVE-2025-31334 was published on 2025-04-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:rarlab:winrar:*:*:*:*:*:*:*:*

More vulnerabilities in Rarlab Winrar

CVE-2008-7144 — Critical (CVSS 10.0): Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to…
CVE-2004-1254 — Critical (CVSS 10.0): WinRAR 3.40, and possibly earlier versions, allows remote attackers to execute arbitrary code via a ZIP file containing…
CVE-2004-0234 — Critical (CVSS 10.0): Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as…
CVE-2006-3845 — Critical (CVSS 9.3): Stack-based buffer overflow in lzh.fmt in WinRAR 3.00 through 3.60 beta 6 allows remote attackers to execute arbitrary…
CVE-2025-8088 — High (CVSS 8.8): A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code…
CVE-2025-6218 — High (CVSS 7.8): RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…

All CVEs affecting Rarlab Winrar →

Other CWE-356 vulnerabilities

CVE-2025-2450 — High (CVSS 8.8): NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability…
CVE-2022-39362 — High (CVSS 8.8): Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and…
CVE-2019-6737 — High (CVSS 8.8): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay…
CVE-2025-3909 — High (CVSS 8.1): Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the…
CVE-2025-3839 — High (CVSS 8.0): A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user…
CVE-2026-0777 — High (CVSS 7.8): Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote…

Browse all CWE-356 vulnerabilities →