Quick Answer — In August 2023, WinRAR shipped a fix for CVE-2023-38831, a zero-day in its aged file-format handling that let a malicious archive execute attacker code when a victim double-clicked a benign-looking file inside it — and researchers then proved APT groups had been exploiting that exact trick since early 2023 (and that the underlying code had been broken since roughly 2004). The story of a 19-year-old bug in the world’s most-downloaded archiver became the definitive argument for fuzzing your parsers and sunset-ing legacy code paths — because attackers don’t care how old the code is, only that it runs.
What happened
- The bug class: A path/extension-confusion flaw in how WinRAR handled archives containing crafted file structures — clicking a decoy file (a benign JPG or PDF) inside the archive executed a sibling payload instead.
- In-the-wild use: Google TAG and others documented operators — including trader-focused APTs targeting Russian-language users and brokerages — running this exact lure via email since at least March 2023, months before the disclosure.
- The age reveal: The vulnerable code dated back to a 2004-era third-party library (UNACEV3) that had never been audited or replaced — making the bug nearly two decades old at disclosure.
Why legacy parsers rot
| Factor | What it did here |
|---|---|
| Third-party binary, no source | Vendor literally couldn’t audit what they shipped |
| Format-era code (2004) | Threat model predates APTs, fuzzing culture, and even modern Windows |
| Parser = attack surface | Any file-format parser processes untrusted input by definition |
| Popularity × legacy | Hundreds of millions of installs running unaudited decode paths |
| No crash = no bug | Nineteen years without an incident report ≠ nineteen years of correctness |
Timeline
| Date | Event |
|---|---|
| 2004 | UNACEV3 third-party ACE-parsing code enters the WinRAR codebase — never meaningfully updated again |
| 2023-01 → 03 | APT operators weaponize the flaw in spraying campaigns against traders and brokerages |
| 2023-06 | Zero Day Initiative researchers report the flaw to WinRAR after finding in-the-wild traces |
| 2023-08-02 (our peg week) | WinRAR 6.23 ships the fix; TAG publishes campaign analysis — the bug becomes CVE-2023-38831 |
| 2023-08 → 09 | Massive patch-adoption push; the “19-year-old bug” framing enters mainstream security writing |
| 2023-Q4 → | CISA KEV listing; enterprise audits sweep for archaic parser dependencies across the stack |
Defensive lessons
- Fuzz every parser you ship — or that ships to you. File-format parsers consume untrusted input as a job description; modern fuzzing would have found this in hours, and its absence let a trivially findable flaw live for nineteen years.
- Unmaintained third-party binaries are unbounded risk. If the vendor can’t read the source, neither can your auditors — legacy binary blobs deserve deletion dates, not anniversary parties.
- Assume old bugs have young exploits. The flaw predated the campaigns by two decades, but exploitation started the moment someone looked; age provides zero protection, only obscurity — which institutional fuzzing sells cheaply.
- Watch for the lure pattern. Archive-with-decoy is a social-engineering multiplier: users are trained to trust what they can preview; your mail gateway should treat nested executables-in-archives as high-risk regardless of file extension shown.
The supply-side irony
The bitter footnote: WinRAR’s business model — essentially unlimited trials with a license nag — kept a codebase commercially alive but minimally funded for decades, and the ACE format it kept supporting had been effectively dead as a legitimate format since the mid-2000s. The vulnerable path existed to serve a ghost format nobody legitimately used anymore. That pattern is everywhere in the installed base: compatibility shims for dead formats are unmonitored doors, and every one of them is an argument for the ruthless removal of code whose only remaining function is risk. The 2023 fix didn’t patch the ACE path; it deleted it — which should have been the design decision nineteen years earlier.
Why it still matters in 2026
CVE-2023-38831 remains the cleanest case study in the legacy-code liability ledger: no zero-day romance, no nation-state mystique — just old code, forgotten dependencies, and an attacker who finally read it. It fueled the 2024–26 wave of parser-fuzzing mandates (big vendors now fuzz every format handler continuously, and enterprises increasingly demand SBOM-plus-fuzz evidence from their tool vendors). And the exhibit-A stat it left behind — a bug older than many of its victims’ careers — still anchors every “technical debt is security debt” slide deck in the industry.
Who was exploiting it?
Per Google TAG’s reporting: APT groups with a financial-espionage flavor — notably campaigns targeting trading-focused victims (traders using trading software, broker accounts, crypto wallets) via archive lures, plus Sandworm-adjacent activity in separate reporting. Multi-operator adoption of a single zero-day is the classic sign a bug is easy to find — and easy to buy.
Did anyone get compromised before the fix?
Yes — documented victims spanned individuals and organizations lured into opening archived “documents,” with implant footprints consistent with access-broker handoffs. Exact victim counts were never fully established, which is itself the lesson: archive-lure telemetry is poor, and exploitation windows of this kind are undercounted by default.
Why did the bug survive 19 years?
Because nothing ever crashed. The flaw produced clean execution, not exceptions — and nobody fuzzed a binary blob whose source they didn’t have. Detection followed motive, not maintenance: it was found because attackers started using it, not because anyone was looking.
Should I still use WinRAR?
Patched, current WinRAR is a normal, acceptable tool — but the episode argues for the broader habit: prefer archivers with active codebases, minimal format surface, and vendors who publish their fuzzing. The risk was never the brand; it was the inertia behind the brand.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
