Microsoft December 2025 patch Tuesday fixes one actively exploited, 3 critical, total of 57 flaws

Microsoft released its December 2025 Patch Tuesday security updates, addressing a total of 57 vulnerabilities. This final security update of the year includes one actively exploited zero-day vulnerability and two publicly disclosed zero-days. The patch also fixes three critical remote code execution vulnerabilities affecting Microsoft Office products. 

Zero day flaws

• CVE-2025-62221 (CVSS score 7.8), tracked as a Windows Cloud Files Mini Filter Driver elevation of privilege flaw. This use-after-free vulnerability has been actively exploited in the wild, allowing authenticated attackers with low privileges to elevate their access to SYSTEM level through local system access. Microsoft confirmed that exploitation has been detected, but details about the attack methods have not been disclosed. The vulnerability affects all supported versions of Windows. The Cybersecurity and Infrastructure Security Agency has added this vulnerability to its Known Exploited Vulnerabilities catalog
• CVE-2025-64671 (CVSS score 8.4) affects GitHub Copilot for JetBrains and represents a command injection vulnerability that allows unauthenticated local attackers to execute arbitrary code. The flaw can be exploited through malicious cross-prompt injection in untrusted files or MCP servers, enabling attackers to execute additional commands by appending them to commands allowed in the user's terminal auto-approve setting.
• CVE-2025-54100 (CVSS score 7.8), a PowerShell remote code execution vulnerability involving command injection. This flaw could cause scripts embedded in webpages to execute when retrieved using Invoke-WebRequest. Microsoft has implemented a warning prompt that appears when PowerShell uses this command, recommending users add the -UseBasicParsing switch to prevent code execution.

Critical vulnerabilities

• CVE-2025-62554 (CVSS score 8.4) - Microsoft Office Remote Code Execution Vulnerability involving type confusion weakness
• CVE-2025-62557 (CVSS score 8.4) - Microsoft Office Remote Code Execution Vulnerability involving use-after-free condition
• CVE-2025-62562 (CVSS score 8.4) - Microsoft Outlook Remote Code Execution Vulnerability

The vulnerabilities span multiple categories, 

• 28 elevation of privilege flaws,
• 19 remote code execution issues,
• 4 information disclosure vulnerabilities,
• 3 denial of service flaws,
• 2 spoofing vulnerabilities. 

Full patch list