WinRAR does not update itself — and that is exactly the problem

WinRAR has no update mechanism. No background service, no notice on launch, no hint that the installed copy is three years old. Whatever was rolled out once stays put until somebody downloads a new file by hand. Which is why four WinRAR flaws sit in the CISA catalogue of known exploited vulnerabilities — three of them carrying the ransomware marker.

Why there is no updater

This is not an oversight. Asked about it by PCMag in November 2023, WinRAR developer Eugene Roshal said Windows offers no way to auto-update desktop apps downloaded from websites, so “every developer needs to reinvent the wheel”. He added that RARLAB had considered update notifications, but corporate system administrators disliked the idea and preferred a centralised approach to software updates over popups on their users’ machines.

The reasoning holds — as long as that centralised approach exists and WinRAR is in it. In a lot of estates neither is true. WinRAR was installed once because somebody had to open a RAR file, and never touched again. The vendor is staying quiet out of deference to a process that, in this particular case, nobody set up.

What that has cost so far

All but CVE-2025-6218 also carry CISA’s ransomware marker. Note the span: seven years between the oldest and the newest identifier. A machine set up in 2018 and never revisited is not one patch behind, it is behind four separate incidents.

The oldest lived in a DLL for the ACE archive format that had not been maintained since 2005. Check Point, who found it in 2019, put the bug’s age at 19 years; RARLAB had no source code for the library and dropped ACE support outright. In 2023, Group-IB documented how a ZIP archive holding a folder named exactly like the harmless file beside it turned a double-click into script execution — exploited on trading forums since April 2023, and later picked up by government-backed groups according to Google’s Threat Analysis Group. In 2025, ESET traced spearphishing archives disguised as job applications to the Russia-aligned RomCom group: the archives hid files in alternate data streams and dropped them into the startup folder on extraction. RARLAB fixed it the same day it was told, 24/07/2025; the finished 7.13 followed six days later.

One row deserves a second look. CVE-2025-6218, fixed back in 7.12, entered the KEV catalogue almost four months after CVE-2025-8088, which needed 7.13. A flaw being quiet today is not evidence that it stays quiet. The KEV list does not assign a severity score — it assigns a date.

Three ways that actually work

Let a package manager do it. winget knows the product as RARLab.WinRAR, Chocolatey as winrar, so winget upgrade --id RARLab.WinRAR or choco upgrade winrar is the whole job. One catch: a report in the winget package repository describes version detection getting stuck afterwards — the upgrade installs and the program reports the new version, but winget keeps listing it as outdated; the reporter suspects the localised installer. Verify against the installed file, not the tool output.

Push it through the deployment tool you already have. There is no MSI, but the installer takes switches. The winget manifest for version 7.23.0 records -s1 for a silent install, -s2 for silent with progress and -d"C:\Path" for the target folder — enough to wrap it for Intune, SCCM or anything comparable. To learn what is installed today, read the file version rather than asking users: (Get-Item "$env:ProgramFiles\WinRAR\WinRAR.exe").VersionInfo.FileVersion. On a single machine, Help > About WinRAR says the same thing.

Or shrink the surface. Windows 11 by now reads RAR, 7z, tar and several other formats natively in File Explorer, built on the libarchive library, as set out in the Windows Insider blog of 18/08/2023. Where WinRAR only exists so people can open archives others sent them, it does not need to exist. Uninstalled is the one version that is reliably not vulnerable.

The copy you do not know about

CVE-2025-8088 did not only affect WinRAR itself. ESET names software that builds on the publicly available Windows version of UnRAR.dll or its source code as affected too — so a program that bundles that library and never refreshed its dependencies stays vulnerable on machines where WinRAR was never installed. An inventory that only asks which programs are installed will not find those. A file system search for the DLL name will.

The honest limitation

The deadlines in the table bind US federal agencies, not you. What makes them useful is what stands behind them: somebody observed exploitation, and an agency put a number of days on it. And four entries do not mean WinRAR only ever had four flaws — the catalogue takes in nothing but what was demonstrably used in attacks. Version 7.23 closed a heap overflow in RAR5 recovery volume reconstruction plus a symbolic link issue, per the vendor change log; neither is in the KEV catalogue, and both are still reasons to update. A notification is also not a deployment path. It only tells you when to use the one you have.

When the software will not speak up

With software that carries its own updater, the question is whether the updater runs. With WinRAR the question is whether anyone knows a new version exists — so the signal has to come from outside the program. The WinRAR product page shows the current tracked release — 7.23.0, vendor date 18/08/2026 — next to the four KEV entries from the table above, each with its catalogue date and CISA deadline. Tick the product and you get an email when RARLAB publishes a new version: free, no account, one-click unsubscribe. The wider view is on the CVE page.

KEV entries, catalogue dates, deadlines and ransomware markers from the CISA catalogue as mirrored in our own dataset, as of 19/08/2026: four entries, three with a ransomware marker, current tracked release 7.23.0. Fixed versions and background from Check Point (2019), Group-IB and Google TAG (2023), Zero Day Initiative advisory ZDI-25-409 with the matching NVD entry (2025), ESET (2025) and the RARLAB change log. Statements about the missing updater from PCMag’s November 2023 interview with Eugene Roshal. External sources retrieved 19/08/2026.