WinRAR ACE Format Vulnerability

For anyone using the WinRAR unpacker/archive software, I suggest you do an update ASAP!

A vulnerability was discovered in the ACE archive format that allowed for a very old (19 years) “Absolute Path Traversal” bug that could be leveraged to execute malware on the infected system. This was delivered using a specially crafted ACE archive that allows hackers to extract files to a location of their choice, which could easily be a system location that replaces system files with their own or the start-up directory in Windows.

ACE is a proprietary data compression archive file format developed by Marcel Lemke, and later bought by e-merge GmbH. The peak of its popularity was 1999–2001, when it provided slightly better compression rates than RAR, which has since become more popular (Wikipedia).

The support for the ACE format has now been removed from WinRAR, hence the advice to do an update.

This issue has been widely reported in the press, so it shouldn’t be hard to find a full technical breakdown of this issue if you really want to. It is also tracked under the CVE number CVE-2018-20250.

Headline image provided by ShutterStock

Comments are closed.

Create a website or blog at

Up ↑

%d bloggers like this: