- Security researchers reveal new error in WinRar
- The error enabled threat actors
- WinRar released a new version to resolve the error so update now
Experts have revealed an error in WinRar that could allow threat actors to get around the brand on the Internet (MOTW) and implement malware on people’s computers.
The vulnerability was discovered by Japanese scientist Shimamamine Taihei from Mitsui Bussan Secure Directions and is now traced as CVE-2025-31334 and got a severity of 6.8/10 (medium).
MOTW is a security mechanism that shows a warning when an executable file is downloaded from the Internet. It is built into Windows and acts as an extra layer of security, warning that people downloaded from the Internet can be dangerous – however, there is a way to work around the warning when a file is shared in a filed format.
Symlink
“If Symlink, pointing to an executable, was started from Winrar Shell, the executable brand of the web data was ignored,” Winrar explained the vulnerability.
A symlink (card for symbolic link) is a shortcut or alias to a file or directory. Instead of copying a file, a symlink just points to it. Therefore, a hacker could create a symlink pointing to an executable with Motw, and if a victim runs it, Motw would not show.
The vulnerability was found in all older versions of WinRar and it was processed in version 7.11, which can now be downloaded.
Ever since Mark on the web was introduced, cyber criminals have been looking for different ways of bypassing it and delivering malware without warning.
At the end of January 2025, 7-ZIP patched a big mistake that activated just that. It is tracked as CVE-2025-0411 and got a high severity, 7/10. Earlier, by 2022, researchers found a password-protected .ZIP file with a .iso-file inside that was able to bypass Motw.
To mitigate the risk, users must always keep their bow up to date and pay attention when downloading files from the Internet.
Via Bleeping computer
