Microsoft Patch Tuesday security updates for December 2025 fixed an actively exploited zero-day

Microsoft’s December 2025 Patch Tuesday fixed 57 vulnerabilities across Windows and its components, Office, Edge, Exchange Server, Azure, Copilot, PowerShell and Windows Defender, with three rated Critical and the remainder Important. One flaw, CVE-2025-62221, is actively exploited in the wild and relates to a Windows Cloud Files Mini Filter Driver that could let an attacker gain SYSTEM privileges locally.

Two other publicly known flaws, CVE-2025-64671 and CVE-2025-54100, are remote code execution issues in GitHub Copilot for JetBrains and PowerShell, respectively, with Microsoft noting a proof-of-concept exists for the Copilot flaw. The Copilot vulnerability enables local command execution via malicious cross-prompt injections in untrusted files or MCP servers, while the PowerShell issue could execute scripts embedded in webpages fetched with Invoke-WebRequest; a warning to use -UseBasicParsing was added. The full list of CVEs addressed by Microsoft for December 2025 is available via the linked update guide.