CISA KEV Alert: WinRAR Zero-Day Used for Malware Injection and Windows UAF RCE Under Active Attack

According to CISA KEV, the agency has added two critical vulnerabilities to its Known Exploited Vulnerabilities Catalog, with active exploitation observed in the wild. The first, CVE-2025-6218, affects WinRAR 7.11 and earlier on Windows and can be exploited by malicious archives to silently extract files to sensitive locations such as the Windows Startup folder, potentially enabling malware insertion.

Observers note that in July 2025 a threat actor known as “zeroplayer” was seen selling a WinRAR zero-day exploit on Exploit[.]in for $80,000, and security researchers believe Paper Werewolf (also known as GOFFEE) has weaponised the flaw in recent campaigns, though exploitation requires user interaction.

The second vulnerability, CVE-2025-62221, targets the Windows Cloud Files Mini Filter Driver and is described by Microsoft as a Use after free flaw that allows an authorised attacker to escalate privileges locally to SYSTEM. With these flaws under active exploitation, CISA has mandated that Federal Civilian Executive Branch agencies remediate them by 30 December 2025 to secure networks against the evolving threats.