CVE-2005-3262: RARLAB WinRAR

High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days.

Format string vulnerability in RARLAB WinRAR 2.90 through 3.50 allows remote attackers to execute arbitrary code via format string specifiers in a UUE/XXE file, which are not properly handled when WinRAR displays diagnostic errors related to an invalid filename.

Affected products

• RARLAB WinRAR: version 2.90 only; version 3.0.0 only; version 3.10 only; version 3.10_beta3 only; version 3.10_beta5 only; version 3.11 only; …

Published 2005-10-20. Last modified 2026-06-16.