---
id: 5117
title: "[CVE-2021-35052] WinRAR’s vulnerable trialware: when free software isn’t free"
cve: CVE-2021-35052
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/winrars-vulnerable-trialware-when-free-software-isnt-free/"
published_at: "2021-10-20T14:01:45Z"
tags: ["rce", "vulnerability-research", "cve", "mitm", "winrar"]
phying_url: "https://phying.com/item/5117"
lang: en
---

# [CVE-2021-35052] WinRAR’s vulnerable trialware: when free software isn’t free

## Summary

A chance find in WinRAR 5.70: its expired-trial notification window loads remote content through the legacy IE engine over HTTPS, so an attacker who can intercept traffic or spoof DNS can return a malicious redirect and achieve RCE. Tracked as CVE-2021-35052.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **CVE:** CVE-2021-35052
- **Published:** 2021-10-20T14:01:45Z
- **Original:** https://swarm.ptsecurity.com/winrars-vulnerable-trialware-when-free-software-isnt-free/
- **Phying News:** https://phying.com/item/5117