A newly discovered zero-day in the widely used WinRAR file-compression program has been exploited for four months by unknown attackers who are using it to install malware when targets open booby-trapped JPGs and other innocuous inside file archives.
The vulnerability, residing in the way WinRAR processes the ZIP file format, has been under active exploit since April in securities trading forums, researchers from security firm Group IB reported Wednesday. The attackers have been using the vulnerability to remotely execute code that installs malware from families, including DarkMe, GuLoader, and Remcos RAT.
As far as I know UniExtract never uses unrar.exe on Zip files, that said, better to update the package than risk unintended or unexpected corner cases.
Bioruebe
commented
1 year ago
https://arstechnica.com/security/2023/08/winrar-0-day-that-uses-poisoned-jpg-and-txt-files-under-exploit-since-april/
As far as I know UniExtract never uses unrar.exe on Zip files, that said, better to update the package than risk unintended or unexpected corner cases.