CVE-2025-8088

CVE-2025-8088 PoC（仅限教育用途） 有关此 CVE 的详细信息，请访问：https://nvd.nist.gov/vuln/detail/CVE-2025-8088 ⚠️ 警告： 本仓库包含针对 CVE-2025-8088 的概念验证（PoC）代码。 它仅用于教育目的、研究和实验室环境 。 请不要 在你不拥有或未经明确许可测试的系统上使用此代码。 概述 本项目演示了如何将备用数据流（ADS）负载嵌入到 WinRAR 压缩包中。 它旨在展示某些 Windows 应用程序如何处理文件流和压缩包处理，专门用于研究和实验室测试 。 要点： 支持 RAR5 格式 。 支持多个诱饵文件...

7-Zip <= 26.01 Mark-of-the-Web Bypass (CVE-2026-58052)

The version of 7-Zip installed on the remote Windows host is 26.01 or earlier. It is, therefore, affected by a vulnerability: - 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier...

CVE-2026-14164

CVE-2026-14164 concerns libarchive’s RAR5 reader. A double-free arises when a filtered_buf pointer remains stale after being freed during unpack state reinitialization, allowing a second free on processing a subsequent archive entry. The issue is triggered by parsing a specially crafted RAR5 arch...

CVE-2026-58052

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched...

CVE-2026-58052 7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched...

PT-2026-53084

Name of the Vulnerable Software and Affected Versions 7-Zip for Windows versions prior to 26.02 Description 7-Zip fails to preserve the Mark-of-the-Web MotW when extracting a specially crafted RAR5 archive. The software uses a guard to suppress archive-supplied Zone.Identifier streams, but it onl...

EulerOS Virtualization 2.13.0 : libarchive (EulerOS-SA-2026-2401)

According to the versions of the libarchive packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archivereaddat...