Caution: WinRAR error bypasses Windows security warnings
A critical security gap in the popular pack program WinRAR enables attackers to avoid a central Windows protection function. So there is the possibility to carry out unnoticed manipulations. All versions are affected before 7.11.
Dangerous vulnerability discovered in WinRAR
The Weak point CVE-2025-31334 undermines the “Mark of the Web” (Motw) protection, which characterizes files downloaded from the Internet as potentially dangerous. With a special constellation with symbolic links, the warning is not displayed when opening so that users can fall into a trap without noticing it.
In WinRAR versions before 7.11 there is a problem that deals with the safety warning function ‘Mark of the Web’ for files when a symbolic link is opened that refers to a executable file. If a symbolic link specially created by an attacker is opened on the affected product, any code can be executed. CVE-2025-31334
Medium risk with high damage potential
According to the bleeping computer the weak point received a CVSS score of 6.8 and was therefore classified as a medium risk. This is because for the creation of symbolic links under Windows Administrator Rights, which makes it difficult to attack.
Not the first Motw bypass
The safety gap by Shimamine Taihei from Mitsui Bussan Secure Directions, which was reported via the Japanese IPA, was discovered. Bypasses of the Motw mechanism are not new. At the beginning of 2025 it was announced that Hacker exploited a similar weak point in the 7-Zip program to distribute malware. WinRAR also had to struggle with such problems before.
The Mark of the web mechanism from Microsoft, active since 1997, marks downloaded files and triggers security warnings that offer additional protection. WinRAR 7.11 not only fixes this weak point, but also offers improvements in the handling of CAB archives and fixes various mistakes. Since version 7.10, certain motw information can also be removed that are considered a data protection risk.
Immediate update recommended
There is still good news for users: there is currently no evidence of active use of this weak point. All WinRAR users should immediately update version 7.11 to protect themselves.
