CVE-2023-38831: listed in the CISA KEV catalog

CVE-2023-38831 · CVSS 7.8 HIGH · EPSS 98% · KEV 2023-08-24

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.

Is CVE-2023-38831 exploited?

• Listed in the CISA KEV catalog on 2023-08-24.
• Federal remediation due 2023-09-14.
• Past that date by 1066 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 98%.
• Public exploit code: packaged in a public tool.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2023-38831

• FrostyNeighbor Quietly Filters Targets Before Delivery (2026-05-20)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/windows/fileformat/winrar_cve_2023_38831

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.