RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.
Conclusion & alert: CVE-2023-40477 is rated High Risk (65.3/100): CVSS High severity, with high exploitation likelihood (EPSS 91.89%, 100th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-22 | 92.64% | 91.89% | -0.76% |
| 2 | 2026-04-23 | 92.80% | 92.64% | -0.16% |
| 3 | 2025-11-20 | — | 92.80% | — |
Full EPSS history (26 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.8 | 3.0 | HIGH |
|
1.8 | 5.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2023-40477 not yet assigned priority: Debian including 3 source packages (libclamunrar, rar, unrar-nonfree), 15 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 15. | https://security-tracker.debian.org/tracker/CVE-2023-40477 |
gentoo
|
normal | CVE-2023-40477: 2 GLSA(s) (202309-04, 202507-03), 3 atom(s) (app-antivirus/clamav, app-arch/rar, app-arch/unrar); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2023-40477 |
suse
|
high | CVE-2023-40477 severity important: SUSE including 30 source package names (clamav-0.103.11-150000.3.50.1, clamav-0.103.11-150600.16.7, …), 110 product×package rows across 30 product lines (Image SLES12-SP5-SAP-Azure-LI-BYOS-Production, Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production, … (30 product lines)): Fixed 110. | https://www.suse.com/security/cve/CVE-2023-40477/ |
ubuntu
|
medium | CVE-2023-40477 medium priority: Ubuntu including 3 source packages (libclamunrar, rar, unrar-nonfree), 36 status rows across 12 suites (bionic, focal, jammy, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): released 16, not-affected 9, needed 6, ignored 5. | https://ubuntu.com/security/CVE-2023-40477 |