CVE-2025-8088
Act now ● On CISA KEV — actively exploited used in ransomware
Actively exploited — on the CISA KEV list.
CVSS base
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
94.1%
99.8th percentile
CISA KEV
Listed
Added 2025-08-12 · patch by 2025-09-02
Weakness / dates
CWE-35
Published 2025-08-08 · modified 2026-08-11
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | R | Required |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | H | High |
Timeline
- 2025-08-08 — Published (NVD)
- 2025-08-12 — Added to CISA KEV (actively exploited)
- 2025-09-02 — CISA patch-by deadline
- 2026-08-11 — Last modified (NVD)
Description
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
Affected
References
- https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5
- https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/
- https://support.dtsearch.com/faq/dts0245.htm
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-day
- https://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeo
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088
- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088