CVE-2023-40477

CVE-2023-40477 is a critical remote code execution vulnerability affecting RARLAB WinRAR, stemming from improper validation of array indexes when processing recovery volumes. This flaw allows attackers to execute arbitrary code by tricking users into opening a malicious file or visiting a malicious page. With a CVSS score of 7.8 (High), it requires user interaction but can lead to complete compromise of confidentiality, integrity, and availability. While no public exploit code is available on common platforms like Metasploit or ExploitDB, there is significant community discussion and media coverage, including reports of active exploitation by state-sponsored actors since April, making it a high-priority threat despite not being on the KEV catalog.