CISA Adds Two Known Exploited Vulnerabilities to Catalogue (RARLAB WinRAR, Microsoft Windows)

Du'aine Davis

Observed in the wild

• On 9 December, CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalogue following evidence of active exploitation. The flaws are CVE-2025-6218 (RARLAB WinRAR Path Traversal) and CVE-2025-62221 (Microsoft Windows Use-After-Free).
• Both vulnerabilities are common attack vectors for malicious cyber actors. The WinRAR flaw enables path traversal, potentially allowing arbitrary file overwrite or extraction outside intended directories. The Windows vulnerability involves a use-after-free condition, which attackers can exploit for remote code execution or privilege escalation. These techniques are frequently leveraged in targeted campaigns seeking initial access and persistence.
• CISA urges all organisations to prioritise patching these vulnerabilities immediately. For Microsoft environments, apply the latest security updates and monitor for anomalous memory operations indicative of use-after-free exploitation. Defender users should enable Exploit Protection and Attack Surface Reduction rules. For WinRAR, update to the latest version and restrict untrusted archive handling.

CVE Record: CVE-2025-6218 CVSS: 7.8
CVE Record: CVE-2025-62221 CVSS: 7.8
CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA