This vulnerability is worrying, not many people go down for patches. 🚨

We have previously reported several times about serious vulnerabilities in WinRAR, warning users to update them quickly because there are constant reports that hackers are starting to use these vulnerabilities to attack real victims, not just paper risks anymore.

.

Most recently, the situation is even more worrying when the Google Threat Intelligence Group (GTIG) officially warns that a serious vulnerability in WinRAR, the CVE-2025-8088 code, is being exploited against a wide range of hackers around the world, from common cyber criminals to state-sponsored espionage groups.

.

This vulnerability affects WinRAR version 7.12 and older. It is a Path Traversal vulnerability that allows an attacker to force a program to crack a dangerous file to any location on the system, such as the Windows Startup folder. This means that by simply opening a compressed file with the payload embedded, the malware can be embedded and run automatically as soon as it is next launched.

.

Google explains that hackers often hide dangerous files in compressed files by inserting fake documents like PDFs or common files as decoys. When a user accidentally opens or cracks a WinRAR file, it may unknowingly release a malware file and immediately lead to the installation of additional dangerous programs.

.

One of the groups that has been found to take this vulnerability seriously is RomCom, or UNC4895, which has a history of developing specialized baggore and malware to attack key targets. There are also groups like APT44, Turla, as well as groups linked to China, that use this vulnerability to further distribute malware and data theft tools.

.

Google also points out that this event reflects a major recurring problem: that despite the patch coming out, many users have not updated WinRAR because the program does not have an automatic update system, allowing many machines around the world to remain open to attack easily.

.

The WinRAR development team again warned that all users should update to WinRAR version 7.13 immediately, because the vulnerability is now used every day, and a single compressed file can become a gateway for hackers to take over your machine immediately.

.

Source: bleepingcomputer

# IT News # Includes IT matters # Cough to know # IT