In February 2019, a major security vulnerability in the unacev2.dll library which is used by WinRAR to decompress
ACE archives was discovered. Consequently, WinRAR dropped the support for the ACE format from version 5.70. Self-extracting archives created with versions before 5.31 (including the executable installer of WinRAR itself) are vulnerable to
DLL hijacking: they may load and use DLLs named UXTheme.dll, RichEd32.dll and RichEd20.dll if they are in the same folder as the executable file. It was widely reported that WinRAR v5.21 and earlier had a
remote code execution (RCE) vulnerability which could allow a remote attacker to insert malicious code into a
self-extracting executable (SFX) file being created by a user, "putting over 500 million users of the software at risk". However, examination of the claim revealed that, while the vulnerability existed, the result was merely an SFX which delivered its payload when executed; published responses dismissed the threat, one saying "If you can find suckers who will trust a
.exe labelled as self-extracting archive
[…] then you can trick them into running your smuggled JavaScript". WinRAR 6.23 fixes a critical security vulnerability which allowed the hacker to automatically execute malware distributed in archives under some circumstances. Versions 7.12 and 7.13 for Windows contain important security fixes. ==History==