Microsoft Patches Three Zero-Days Including Active Cloud Files UAF to SYSTEM and Copilot RCE

Microsoft wrapped up December with a Patch Tuesday that fixes three zero-day vulnerabilities alongside a broader update addressing 72 flaws across its ecosystem. The most urgent fix targets the Windows Cloud Files Mini Filter Driver, tracked as CVE-2025-62221, a use-after-free flaw that could let attackers gain SYSTEM privileges.

In a notable shift for AI tooling, CVE-2025-64671 affects GitHub Copilot for JetBrains, described as a Remote Code Execution vulnerability where a command injection flaw may allow an unauthenticated attacker to execute code remotely. The third zero-day, CVE-2025-54100, concerns Windows PowerShell and enables remote code execution via a command injection flaw.

After the update, Microsoft added a visible mitigation for script-based attacks in Invoke-WebRequest, prompting users with a security warning and advising the -UseBasicParsing switch to avoid script code execution. The advisory notes that CISA acknowledged active exploitation of the Cloud Files UAF flaw and urged patching before 30 December 2025, according to CISA. Beyond the zero-days, the release also addresses critical RCE bugs in Outlook and the Office suite.