U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2025-6218 (CVSS score of 7.8) RARLAB WinRAR Path Traversal Vulnerability
- CVE-2025-62221 (CVSS score of 7.8) Microsoft Windows Use After Free Vulnerability
CVE-2025-6218 is a WinRAR directory traversal flaw (formerly ZDI-CAN-27198) that allows attackers to execute code by tricking a user into opening a malicious archive or webpage. Crafted file paths inside the archive let the attacker write files outside intended directories, enabling arbitrary code execution with the user’s privileges.
“This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” reads the advisory. “The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user.”
The vulnerability was reported by whs3-detonator.
The vulnerability CVE-2025-62221 is a use after free in Windows Cloud Files Mini Filter Driver that allows an authorized attacker to elevate privileges locally.
“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.” reads the advisory.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by December 30, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Microsoft Patch Tuesday)
