Microsoft Patch Tuesday December 2025

Microsoft’s final Patch Tuesday of 2025, released on December 9, addresses approximately 56-57 vulnerabilities across Windows, Office, Exchange, and related components, including three zero-days and several Critical remote code execution flaws. The standout issue is CVE-2025-62221, an actively exploited elevation-of-privilege vulnerability in the Windows Cloud Files Mini Filter Driver, already added to CISA’s Known Exploited Vulnerabilities catalog. This update demands rapid deployment, especially ahead of holiday slowdowns, to mitigate risks in widely used cloud-sync environments like OneDrive.

Zero-Days and High-Priority Exploits

The release patches three zero-days, with CVE-2025-62221 leading as a use-after-free bug in cldflt.sys that allows local authenticated attackers to escalate to SYSTEM privileges. Closely related are CVE-2025-62454 and CVE-2025-62457, additional EoP flaws in the same Cloud Files driver cluster, flagged as more likely to be exploited due to their shared attack surface. Two other zero-days affect PowerShell and GitHub Copilot integrations, both publicly disclosed pre-patch, heightening risks for administrative and developer workflows.

Critical RCE and Kernel Vulnerabilities

Microsoft fixed 2-3 Critical RCE bugs, primarily in Office apps like Word, Excel, and Outlook, where malicious documents can trigger code execution with minimal user interaction. Kernel and driver issues dominate the remainder, including CVE-2025-59516 and CVE-2025-59517 in the Storage VSP driver, CVE-2025-62458 in Win32k, CVE-2025-62470 in the Common Log File System, and CVE-2025-62472 in Remote Access Connection Manager. Networking components like RRAS and ReFS also receive RCE and DoS fixes, critical for exposed servers and VPN gateways.

The release patches three zero-days, with CVE-2025-62221 leading as a use-after-free bug in cldflt.sys that allows local authenticated attackers to escalate to SYSTEM privileges. Closely related are CVE-2025-62454 and CVE-2025-62457,

Microsoft’s December 2025 Patch Tuesday addresses three zero-day vulnerabilities, with CVE-2025-62221 as the primary concern due to confirmed active exploitation.This use-after-free flaw in the Windows Cloud Files Mini Filter Driver (cldflt.sys) enables local authenticated attackers to escalate privileges to SYSTEM level, affecting all supported Windows versions from clients to servers. Often chained with initial code execution from phishing or browser compromises, it powers full system takeover in OneDrive-enabled environments; CISA added it to the KEV catalog with a late-December remediation deadline.

CVE-2025-62221 Details

CVE-2025-62221 exploits a use-after-free condition in cldflt.sys, the kernel-mode driver handling cloud file synchronization for features like Files On-Demand. A local attacker with valid low-privilege credentials triggers the bug by manipulating file operations during sync, freeing memory that the driver later dereferences, allowing arbitrary kernel memory corruption and privilege escalation to NT AUTHORITY\SYSTEM without user interaction beyond authentication.Rated Important with CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), Microsoft confirms real-world attacks, distinguishing it from similar October 2025 race conditions in the same driver.

Attackers target this post-initial-access, leveraging its reliability for sandbox escapes or lateral movement in domain-joined setups. Remediation involves deploying the December 9 cumulative updates (e.g., KB5072033 for Windows 11), with no restart bypass available; validate via Qualys QID queries or Tenable plugins tracking cldflt.sys versions.

CVE-2025-62454 Details

CVE-2025-62454, another Important-rated EoP (CVSS 7.8) in the Windows Cloud Files Mini Filter Driver, shares the cldflt.sys attack surface with CVE-2025-62221, enabling SYSTEM escalation via crafted file operations. Microsoft tags it “Exploitation More Likely” due to low complexity and no privileges beyond local access, positioning it as a natural pivot if primary zero-days are patched. Unlike the UAF in CVE-2025-62221, specifics remain undisclosed pre-PoC, but driver overlap suggests similar sync-triggered manipulation.

Patch alongside CVE-2025-62221 as a cluster, as reverse-engineering often reveals chainable primitives; monitor EDR for anomalous cldflt.sys activity like unexpected IRP handling or memory accesses in cloud folders.

CVE-2025-62457 Details

Completing the Cloud Files triad, CVE-2025-62457 mirrors the prior two as an Important EoP (CVSS 7.8) in cldflt.sys, allowing local privilege escalation through filter driver mishandling during cloud file I/O. Microsoft assesses exploitation as “Unlikely” versus “More Likely” for CVE-2025-62454, likely due to higher complexity or mitigations, but the shared codebase demands unified treatment.[1] Broad exposure stems from default OneDrive integration on Windows 10/11 and Server editions.

Deploy cumulatives immediately, prioritizing internet-facing or admin endpoints; compensating controls include disabling Files On-Demand temporarily via Group Policy (Computer Configuration > Administrative Templates > OneDrive > “Enable Files On-Demand”) and auditing driver loads with Sysmon rules for cldflt.sys. Full fleet scanning confirms coverage, as these form a high-probability post-exploitation path.

Affected Products and Attack Surface

Patches span Windows 10/11 and Server editions (including builds like 20348 via KBs such as 5072033, 5071417, and 5071547), Office/365, Exchange Server, PowerShell, Projected File System, Windows Message Queuing, and Edge. Elevation-of-privilege flaws make up about half the total, followed by 19 RCEs, with the rest covering info disclosure, DoS, and spoofing. Windows 10 users beyond mainstream support need Extended Security Updates for coverage.

Remediation Roadmap

Prioritize Tier 1 patching for CVE-2025-62221 and its driver siblings, plus Office Critical RCEs on endpoints, admin hosts, and internet-facing systems. Tier 2 targets kernel drivers (Storage VSP, Win32k, CLFS, RRAS) and Exchange/PowerShell updates for infrastructure. Implement interim controls like Constrained Language Mode for PowerShell, macro blocks, and EDR monitoring for cldflt.sys anomalies. Validate via vulnerability scanners and Microsoft’s Update Guide, aiming for full fleet coverage before year-end.