Microsoft Patch Tuesday December 2025 released

Microsoft has released its final Patch Tuesday for 2025, bringing 57 security fixes in a package that includes three zero-day vulnerabilities . One of them has already been actively exploited by malicious actors. While the total number of vulnerabilities is significant, security experts are particularly concerned about zero-days, as they can be exploited before an official patch is even available.

Of the overall vulnerabilities on Patch Tuesday, three critical RCE (Remote Code Execution), which allow attackers to remotely execute malicious code.

See also: Fortinet, Ivanti and SAP patch critical vulnerabilities

Patch Tuesday: The categorization of fixes is as follows:

• 28 privilege escalation vulnerabilities
• 19 remote code execution (RCE) vulnerabilities
• 4 information leakage vulnerabilities
• 3 vulnerabilities that allow Denial of Service (DoS) attacks
• 2 spoofing vulnerabilities

It's worth noting that the numbers don't include updates to Microsoft Edge or Mariner, which were released earlier in the month.

Microsoft Patch Tuesday December 2025: Zero-day vulnerabilities

The actively exploited zero-day: CVE-2025-62221

The most concerning discovery is the vulnerability CVE-2025-62221 , which is already being exploited by attackers. The issue is located in the Windows Cloud Files Mini Filter driver , where a use-after-free vulnerability allows an attacker with local access to gain SYSTEM privileges , the highest level of access in Windows.

See also: Emby Server: Critical vulnerability allows administrator access

Microsoft has not disclosed details about how the attackers exploited the flaw, but the fact that the vulnerability was detected by the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC) indicates that this is a high-severity.

Two more zero-days released

CVE-2025-64671 – GitHub Copilot for JetBrains

The second zero-day, which is fixed by the new Patch Tuesday, concerns GitHub Copilot . A command injection vulnerability allows unauthorized users to execute commands via Cross Prompt Injection if the user opens untrusted files or connects to untrusted MCP servers.

The flaw was discovered by researcher Ari Marzuk, as part of his research that highlighted a new class of attacks on AI-powered IDEs.

CVE-2025-54100 – PowerShell RCE

The third zero-day is related to PowerShell and allows execution of malicious code via web pages retrieved with the Invoke-WebRequest. Microsoft has now added a warning that urges the user to use the –UseBasicParsing to prevent execution of embedded scripts.

The vulnerability was attributed to a team of security researchers, with many names contributing to its discovery.

Why zero-days are a growing risk

Zero-days are not just “unknown” vulnerabilities. They are vulnerabilities that:

• are used before there is a patch,
• sold on cybercriminal markets,
• often target businesses, government organizations and cloud infrastructures,
• they can act as a starting point for lateral movement in entire corporate networks.

In the case of Windows Cloud Files Mini Filter, the fact that only local access is required makes the vulnerability ideal for attacks where the attacker has already gained a foothold in the system through phishing or malware.

See also: Exploiting vulnerabilities in Ivanti Connect Secure to distribute MetaRAT

The last Patch Tuesday of the year confirms once again that the attack surface of modern systems is growing, especially as they integrate AI tools and cloud services. Administrators should install updates immediately, check for unusual activity in logs, and implement Microsoft's new guidelines for the secure use of tools like PowerShell.

In the table below, you can find all the vulnerabilities fixed this month with Microsoft Patch Tuesday:

Source: www.bleepingcomputer.com