Microsoft Patches 57 Vulnerabilities, Three Zero-Days

Microsoft has issued patches for 57 vulnerabilities in its December 2025 security updates, including three zero-days. The exploited zero-day, tracked as CVE-2025-62221 with a CVSS of 7.8, is a use-after-free in the Windows Cloud Files Mini Filter Driver that could allow attackers to elevate privileges to System, and Microsoft says it is being exploited in the wild. A second flaw in the same driver, CVE-2025-62454 (CVSS 7.8), also leads to privilege escalation and is considered likely to be exploited in attacks.

The update also patches two command injections that could lead to remote code execution, CVE-2025-64671 in Copilot for Jetbrains and CVE-2025-54100 in PowerShell, both of which have been publicly disclosed before the patches. In Office, 13 vulnerabilities were fixed, including two critical issues CVE-2025-62554 and CVE-2025-62557 described as type confusion and use-after-free bugs that could enable remote code execution via the Preview Pane and social engineering. In 2025, Microsoft has rolled out patches for roughly 1,200 vulnerabilities. according to Ionut Arghire.