CVE-2005-3262

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-10-20 · updated 2026-06-16

Description

Format string vulnerability in RARLAB WinRAR 2.90 through 3.50 allows remote attackers to execute arbitrary code via format string specifiers in a UUE/XXE file, which are not properly handled when WinRAR displays diagnostic errors related to an invalid filename.

Affected products

WinRAR: 2.90, 3.0.0, 3.10, 3.10_beta3, 3.10_beta5, 3.11 (+5)

References

http://secunia.com/advisories/16973/
http://secunia.com/secunia_research/2005-53/advisory/
http://www.rarlabs.com/rarnew.htm
http://www.securityfocus.com/bid/15062
http://secunia.com/advisories/16973/
http://secunia.com/secunia_research/2005-53/advisory/
http://www.rarlabs.com/rarnew.htm
http://www.securityfocus.com/bid/15062

Get alerted when CVE-2005-3262 or the next vulnerability affects your stack