Hackers Are Using New WinRAR Bug to Breach All Computers in Pakistan

The National Cyber Emergency Response Team (NCERT) has issued a critical cybersecurity advisory regarding a high-severity path traversal vulnerability discovered in the widely used file archiving software WinRAR.

Tracked globally as CVE-2025-8088, the flaw exists in the UnRAR.dll component and affects Windows versions up to and including 7.12.

Given the widespread use of the application across both public and private sector organizations, authorities have warned that the vulnerability poses an immediate risk to desktop environments nationwide.

According to technical details shared by the federal agency, remote attackers can exploit the flaw by tricking users into downloading and opening specially crafted malicious archive files. Once opened, the vulnerability can trigger memory manipulation within the system, allowing attackers to execute arbitrary code with the same privileges as the logged-in user, without requiring administrative access.

The primary risk involves persistence and unauthorized system control. By exploiting the path traversal weakness, attackers can place malicious files in sensitive directories, including Windows Startup folders. This enables malware to execute automatically each time the system boots, potentially giving attackers long-term access and enabling further intrusion or disruption.

In response to the alert, the Government of Sindh’s Science and Information Technology Department has circulated the advisory to all provincial ministries, administrative departments, and law enforcement agencies for immediate compliance. Departments have been instructed to upgrade all WinRAR installations to version 7.13 or later without delay.

IT teams and users have also been directed to inspect startup programs and active services within 24 hours to detect and remove any unauthorized or suspicious entries.

NCERT further advised organizations to scan all archive files using updated antivirus software, avoid downloading files from untrusted sources, and ensure all software updates are obtained only from official websites.

Public sector departments detecting signs of compromise have been instructed to report incidents immediately through the NCERT reporting channels or emergency helpline.