CVE-2019-25677: rarlab winrar

csirt@kutim:~/threat-intel/cve/CVE-2019-25677

CVSS 5.5 · Medium EPSS 0,43%

Kerentanan Creation of Temporary File in Directory with Insecure Permissions pada rarlab winrar. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.

Rincian

Terbit di NVD: 5 April 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-379: Creation of Temporary File in Directory with Insecure Permissions
EPSS (30 hari): 0,43% peluang dieksploitasi; lebih tinggi dari 35,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
rarlab	winrar	Semua versi hingga 5.61

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.vulncheck.com/advisories/winrar-denial-of-service-via-malformed-language-file advisory pihak ketiga
https://www.exploit-db.com/exploits/46432 exploit · vdb entry
https://win-rar.com/predownload.html?spV=true&subD=true&f=wrar561tr.exe product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.