Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days
Summary: Microsoft's December 2025 Patch Tuesday addressed 56 flaws across the Windows platform, including three rated Critical and 53 rated Important, with 29 privilege escalation and 18 remote code execution issues among them. One flaw, CVE-2025-62221 (CVSS 7.8), a use-after-free in the Windows Cloud Files Mini Filter Driver that allows an authorized attacker to gain SYSTEM permissions locally, has been actively exploited and was added to CISA's KEV catalog with a December 30, 2025 patch deadline for FCEB agencies.
What you should know: The exploited driver is a core Windows component present even on systems without OneDrive, Google Drive, or iCloud installed, and chaining it with low-privileged access from phishing or a browser exploit can lead to domain-wide compromise. Microsoft patched 1,275 CVEs in 2025, its second consecutive year above 1,000.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-54100CVE-2025-62221CVE-2025-62223CVE-2025-64671
- Related
- Microsoft Patch Tuesday, December 2025 Edition Cyber Risks ·CVE-2025-62221: Microsoft Windows Use After Free Vulnerability Known Exploited Vulnerabilities · Dec 09, 2025