CVE-2014-125119 WinRAR < 5.00 Filename Spoofing RCE
Attackers can trick users into executing malicious code by spoofing filenames in crafted ZIP archives, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-125119?
CVE-2014-125119 is a high-severity vulnerability in RARLab WinRAR, published on 25 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.
Which versions are affected by CVE-2014-125119?
How do I fix CVE-2014-125119?
No fix has been published for CVE-2014-125119 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-125119 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-125119 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-9pw2-ph2r-gfpc.