Microsoft Patch Tuesday, December 2025 Edition

Summary: Microsoft's December 2025 Patch Tuesday fixed at least 56 security flaws in Windows and supported software, including one zero-day (CVE-2025-62221) already being exploited and two publicly disclosed vulnerabilities. Microsoft patched 1,129 vulnerabilities in 2025, an 11.9% increase from 2024 and the second consecutive year above one thousand.
Key Takeaway: The actively exploited zero-day sits in the Windows Cloud Files Mini Filter Driver, a core component tied to OneDrive, Google Drive and iCloud that remains present even when none of those apps are installed. Microsoft also flagged five non-critical privilege escalation bugs as most likely to be exploited, a reminder that severity labels do not track real-world risk.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-54100 CVE-2025-59516 CVE-2025-59517 CVE-2025-62221 CVE-2025-62458 CVE-2025-62470 CVE-2025-62472 CVE-2025-62554 CVE-2025-62557 CVE-2025-62562 CVE-2025-64671
Related: Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days Cyber Risks ·
Microsoft Patch Tuesday for December 2025 — Snort rules and prominent vulnerabilities Cyber Risks ·
CVE-2025-62221: Microsoft Windows Use After Free Vulnerability Known Exploited Vulnerabilities · Dec 09, 2025