Remote code execution flaw found in old version of WinRAR (theregister.com)

"This Man-in-the-Middle attack requires ARP-spoofing, so we presume that a potential attacker already has access to the same network domain."

No cooment. So RCE if you control the network and maybe the system.