WinRAR 3.40 and possibly earlier versions allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename possibly causing an integer overflow that leads to a buffer overflow.