WinRAR

CVE-2023-38831 let a crafted WinRAR archive execute attacker code off a decoy file click — and researchers proved APT campaigns had been exploiting the 2004-era parser flaw for months before the August 2023 fix.