Microsoft December 2025 Patch Tuesday – 56 Vulnerabilities Fixed Including 3 Zero-days

Microsoft released its final Patch Tuesday updates of 2025 on Dec 9, addressing 56 security vulnerabilities across Windows, Office, Exchange Server, and other components.

This update includes three zero-day vulnerabilities: two publicly disclosed remote code execution issues and one actively exploited elevation of privilege vulnerability.

The patch addresses two critical remote code execution vulnerabilities in Microsoft Office , both rated critical due to their potential for arbitrary code execution via malicious documents.

Several important-rated issues are also addressed, primarily elevation of privilege flaws in Windows kernel drivers like Cloud Files Mini Filter Driver and Win32k, alongside remote code execution bugs in RRAS and ReFS. The likelihood of exploitation varies, with several marked as "More Likely" or "Detected," urging immediate patching during the holiday season.

Vulnerability Type Count

Remote Code Execution 19

Denial of Service 3

Elevation of Privilege 28

Information Disclosure 4

Spoofing 2

Total 56

No moderate or low-severity flaws are highlighted, but the focus remains on preventing local privilege escalation and remote attacks. Affected products include Windows 10/11/Server, Office apps (Excel, Word, Outlook, Access), Hyper-V , Azure Monitor Agent, PowerShell, and third-party tools like GitHub Copilot for JetBrains.

Three zero-days are notable. CVE-2025-64671 in GitHub Copilot for JetBrains enables command injection for local RCE; it is publicly known, but exploitation is less likely. CVE-2025-54100 similarly affects PowerShell via command injection.

CVE-2025-62221, a use-after-free in Windows Cloud Files Mini Filter Driver, shows detected exploitation, marking it actively used in attacks.

CVE ID Component Type Severity Exploitation Status Description Summary

CVE-2025-62221 Windows Cloud Files Mini Filter Driver Elevation of Privilege Important Detected Use-after-free allows local privilege escalation. Yes (exploited in the wild)

CVE-2025-64671 GitHub Copilot for JetBrains Remote Code Execution Important Less Likely Use after free allows local privilege escalation. Yes (exploited in the wild)

CVE-2025-54100 PowerShell Remote Code Execution Important Less Likely Command injection enables local code execution. Publicly known.

Organizations should prioritize testing and deploying these updates via Windows Update or the Microsoft Update Catalog, especially for zero-days and "More Likely" exploits. Extended Security Updates remain critical for Windows 10 users post-EOL.

CVE Title Severity Impact Description

CVE-2025-62554 Microsoft Office Remote Code Execution Vulnerability Critical Remote Code Execution Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-62557 Microsoft Office Remote Code Execution Vulnerability Critical Remote Code Execution Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2025-62454 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important Elevation of Privilege Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2025-62456 Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Important Remote Code Execution Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.

Monitor CISA's Known Exploited Vulnerabilities catalog for additions, and segment networks to limit lateral movement from elevation of privilege flaws. With year-end holidays approaching, automate patching to mitigate risks from the 1,100+ CVEs patched in 2025.

Based on reporting by Cyber Security News.