WinRAR flaw plants a hidden startup backdoor on Windows

Published July 8, 2026 CVE-2025-8088

A hidden flaw in WinRAR lets attackers secretly install a backdoor on your Windows PC. The backdoor, called STOCKSTAY, lets attackers spy on you and run commands without you noticing.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 7.13
Affected versions
through 7.12
Weakness
CWE-35
Exploit likelihood
95% in 30 daysEPSS, higher than 100% of known flaws
Affects
WinRAR
Exploited
Yes, in the wildListed by CISA, used in ransomware
Added to CISA list
Aug 12, 2025
Federal fix deadline
Sep 2, 2025

How it works

Attackers send a fake RAR file that tricks WinRAR into writing a hidden backdoor file to your PC's startup folder, which runs every time you log in.

What to do

Check the installed WinRAR version. This advisory applies to versions older than 7.13 or versions older than 2023.01.

Update WinRAR to 7.13 or 2023.01 or newer. Then verify the installed version.

Technical details

CVE-2025-8088 is a CWE-35 path traversal flaw in the Windows build of WinRAR. The archive extraction routine does not sanitize relative path components that traverse upward out of the destination directory, allowing a crafted archive entry to write an arbitrary file to any path writable by the current user process. Discovered by ESET researchers Anton Cherepanov, Peter Kosinar, and Peter Strycek.

Fixed in WinRAR 7.13. EPSS exploitation probability is approximately 86 percent, reflecting confirmed in-the-wild use. The observed post-exploitation chain uses a Windows Startup folder shortcut for persistence and a reflectively loaded payload executed entirely in memory via PowerShell stages to avoid on-disk detection.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source