CVE-2019-25677 WinRAR 5.61 Denial of Service via Malformed Language File

What is CVE-2019-25677?

CVE-2019-25677 is a medium-severity denial of service vulnerability in Win-Rar WinRAR, published on 5 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.

Weakness: CWE-379

Which versions are affected by CVE-2019-25677?

It affects 1 product.

Products include Rarlab Winrar.

How do I fix CVE-2019-25677?

No fix has been published for CVE-2019-25677 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-25677 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25677 exists.

Other vulnerabilities in Win-Rar WinRAR

• CVE-2025-6218 RARLAB WinRAR Path Traversal Exploited High 7.8
• CVE-2023-38831 RARLAB WinRAR Code Execution Exploited High 7.8
• CVE-2018-20250 WinRAR Absolute Path Traversal Exploited High 7.8
• CVE-2008-7144 Memory corruption in n/a Critical 10.0
• CVE-2004-1254 Integer overflow in n/a Critical 10.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wqh9-pjhr-mh8q.