WinRAR’s 19-year-old bug: update or uninstall
A flaw in WinRAR’s ACE support lets a crafted archive drop malware into your Startup folder. WinRAR doesn’t update itself.
Researchers disclosed last week a bug in WinRAR that has been there for 19 years. A crafted archive in the old ACE format can write a file anywhere on your computer, for example into the Startup folder, so malware runs the next time you log in.
WinRAR has hundreds of millions of users, and it doesn’t update itself. Many computers will run the vulnerable version for years.
What to do:
- Update to WinRAR 5.70, which drops ACE support entirely.
- Or uninstall it. Windows opens ZIP files on its own, and 7-Zip updates more often.
- For companies: check your software inventory for old archive tools on every PC.
- Be wary of archive attachments from outside, whatever the extension says.
Small utilities installed once and forgotten are a big part of every company’s attack surface.