Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero-Days

Microsoft closed out 2025 with patches for 56 security flaws across the Windows platform, including one vulnerability that has been actively exploited in the wild. Of the 56 flaws, three are rated Critical and 53 are rated Important, with two listed as publicly known at the time of release. In total, Microsoft has addressed 1,275 CVEs in 2025, according to data compiled by Fortra, a figure cited as part of the Patch Tuesday update.

The vulnerability under active exploitation is CVE-2025-62221, a use-after-free in Windows Cloud Files Mini Filter Driver that could allow an authorised attacker to elevate privileges locally to obtain SYSTEM permissions; Microsoft Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) have been credited with discovering and reporting the flaw.

The December update also adds two zero-days: CVE-2025-54100, a command-injection flaw in Windows PowerShell, and CVE-2025-64671, a command-injection vulnerability in GitHub Copilot for JetBrains, both enabling local code execution. According to MSTIC and MSRC, the exploitation chain could involve initial access via phishing or other remote-code-execution flaws, followed by privilege escalation and potential domain-wide compromise when combined with credential theft. The U.S.

Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-62221 to the KEV catalog, mandating Federal Civilian Executive Branch agencies to patch by 30 December 2025.