The vulnerability resides in the RarVM.ExecuteCode method of the Junrar library, where a VM_JMP instruction can target an address beyond the prepared program’s code size. The setIP() function incorrectly succeeds without advancing the instruction pointer or decrementing the operation counter, allowing the jump handler to repeat without end. A malicious RAR4 archive can therefore keep an extraction thread in an infinite CPU loop, exhausting the worker capacity used for archive processing. Because the RAR virtual machine does not launch native code, the impact is limited to availability loss rather than remote code execution.

Affects the Junrar Java library for handling RAR archives. Any software using junrar prior to version 7.6.1 is susceptible; the fix is available in release 7.6.1 and later. The issue applies to all Java runtimes that instantiate the RarVM to unpack RAR archives.

The CVSS score of 7.5 indicates a high severity of the denial‑of‑service effect. The EPSS score is below 1 %, suggesting a very low probability of widespread exploitation, and the vulnerability is not yet catalogued in CISA’s KEV. The likely attack vector is local or application‑level, where an attacker crafts a RAR4 archive containing an invalid VM_JMP instruction and forces the application to unpack it. The impact would be a high‑CPU resource drain that can stall or crash the extraction service, affecting overall availability of the application or infrastructure using Junrar.