嗯，用户让我帮忙总结一下这篇文章的内容，控制在一百个字以内。首先，我需要仔细阅读文章，理解其主要内容。文章主要讲的是美国网络安全和基础设施安全局（CISA）将微软Windows和WinRAR的漏洞添加到其已知被利用的漏洞目录中。 接下来，我需要找出关键信息：CISA添加了哪些漏洞？CVE编号是什么？每个漏洞的CVSS评分是多少？以及这些漏洞的影响是什么。文章提到CVE-2025-6218和CVE-2025-62221，评分都是7.8。前者是WinRAR的路径遍历漏洞，可能导致远程代码执行；后者是Windows的Use After Free漏洞，可能导致权限提升。 然后，我需要将这些信息浓缩到100字以内。要注意直接描述内容，不需要使用“这篇文章总结了...”这样的开头。可能的结构是：CISA添加了两个漏洞到KEV目录，分别影响WinRAR和Windows，并给出CVE编号和影响。 最后，检查字数是否符合要求，并确保信息准确无误。这样用户就能快速了解文章的核心内容了。 </think> 美国网络安全机构CISA将微软Windows和WinRAR的两个高危漏洞（CVE-2025-6218和CVE-2025-62221）加入已知被利用漏洞目录，要求联邦机构于12月30日前修复以防范攻击。 2025-12-10 09:33:51 Author: securityaffairs.com(查看原文) 阅读量:13 收藏
U.S. CISA adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog
Pierluigi Paganini
December 10, 2025
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2025-6218 (CVSS score of 7.8) RARLAB WinRAR Path Traversal Vulnerability
- CVE-2025-62221 (CVSS score of 7.8) Microsoft Windows Use After Free Vulnerability
CVE-2025-6218 is a WinRAR directory traversal flaw (formerly ZDI-CAN-27198) that allows attackers to execute code by tricking a user into opening a malicious archive or webpage. Crafted file paths inside the archive let the attacker write files outside intended directories, enabling arbitrary code execution with the user’s privileges.
“This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.” reads the advisory. “The specific flaw exists within the handling of file paths within archive files. A crafted file path can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of the current user.”
The vulnerability was reported by whs3-detonator.
The vulnerability CVE-2025-62221 is a use after free in Windows Cloud Files Mini Filter Driver that allows an authorized attacker to elevate privileges locally.
“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.” reads the advisory.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by December 30, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Microsoft Patch Tuesday)
如有侵权请联系:admin#unsafe.sh