WinRAR has a serious security flaw - worrying zero-day issue lets hackers plant malware, so patch right away

• ESET found a high-severity bug in WinRAR being used by RomCom, a known Russian hacking collective
• The bug was being used to deploy backdoors allowing full access to compromised computers
• WinRAR says it has fixed the issue, so users should update now

Iconic archiving platform WinRAR carried a dangerous zero-day vulnerability which could have let hackers plant malware on compromised computers, security researchers are warning.

Recently, researchers from ESET discovered a directory traversal vulnerability in the latest version of WinRAR. The flaw is now tracked as CVE-2025-8088, and was given a severity score of 8.4/10 (high).

To make matters worse, hackers were seen abusing the flaw in the wild to drop RomCom’s malware variants.