PATCH NOW: Microsoft Fixes 57 Flaws, Including Three Zero-Days Actively Exploited
Microsoft has released its December security updates: Patch Tuesday brings fixes for 57 vulnerabilities, including three zero-days (one of which is already being actively exploited) and three critical remote-code-execution flaws. Administrators and Windows users are strongly urged to install the patches without delay.
This month’s bundle includes 28 elevation-of-privilege flaws, 19 remote-code-execution issues, 4 information-disclosure vulnerabilities, 3 denial-of-service bugs, and 2 spoofing weaknesses. The report does not cover 15 Microsoft Edge vulnerabilities or the Mariner bugs addressed in separate early-December updates. For those following feature updates, Microsoft has also released independent bulletins for the latest Windows 11 cumulative updates (KB5072033 and KB5071417).
The most serious issue of the month is the actively exploited elevation-of-privilege flaw CVE-2025-62221 in the Windows Cloud Files Mini Filter driver. This use-after-free bug enables a local attacker with a valid account to escalate privileges to SYSTEM. It is precisely the sort of vulnerability attackers routinely chain with other bugs: initial access comes first, followed by exploitation of an EoP flaw like this one to seize full control of the host. Microsoft credits MSTIC and MSRC with the discovery but discloses no details regarding attacks already observed in the wild.
Two additional zero-days fixed in this release had been publicly disclosed prior to patching, significantly increasing the risk of attempted exploitation.
The first, CVE-2025-64671 in GitHub Copilot for JetBrains IDEs, is a remote-code-execution vulnerability arising from improper filtering of special characters in commands — a classic case of command injection. In essence, an attacker can achieve arbitrary code execution locally if they can induce Copilot to generate or complete a terminal command. Microsoft highlights an especially risky scenario: Cross Prompt Injection, where malicious prompts are embedded in untrusted files or MCP servers. With automatic command confirmation enabled, harmful trailing commands may be silently appended to ostensibly legitimate ones. Researcher Ari Marzuk detailed this flaw in his work “IDEsaster: A Novel Vulnerability Class in AI IDEs,” demonstrating how AI-assisted IDE tooling itself becomes an attack surface.
The second publicly disclosed zero-day, CVE-2025-54100 in Windows PowerShell, is likewise a command-injection flaw. When using Invoke-WebRequest, scripts embedded in a fetched web page could be executed during parsing. Simply retrieving a page’s contents through PowerShell could therefore trigger arbitrary code execution if the page were malicious.
As mitigation, Microsoft has changed PowerShell’s behavior: Invoke-WebRequest now displays a warning about the risk of executing scripts from web content and recommends adding the -UseBasicParsing switch to disable advanced parsing and eliminate the execution vector. This is a significant change for administrators and developers who rely heavily on web requests in automation. Legacy scripts should be reviewed and updated to explicitly specify the intended mode of operation.
Among the critical vulnerabilities, three stand out in Microsoft Office: two RCE flaws in Office (CVE-2025-62554 and CVE-2025-62557) and one in Outlook (CVE-2025-62562). As is typical for this class of bugs, merely opening a specially crafted document or email could permit arbitrary code execution with the user’s privileges. In corporate environments, this remains one of the most reliable vectors for phishing and targeted intrusion campaigns.
Beyond Office, the update addresses a wide range of vulnerabilities across Windows system components: Windows Storage VSP and ReFS drivers, the Windows Projected File System, Win32k, and Windows Shell. Additional flaws affect Remote Access Connection Manager, Routing and Remote Access Service (RRAS), DirectX, and Hyper-V. Many are classified as Important and may facilitate persistence, isolation bypass, or lateral movement once an attacker has gained a foothold.
Server products are also impacted: the release fixes privilege-escalation and spoofing flaws in Microsoft Exchange Server, as well as issues in SharePoint Server — making December’s patches particularly critical for administrators of enterprise environments where these services are commonly exposed to the internet.
Several other vendors have issued December bulletins to accompany Microsoft’s release. Adobe has patched vulnerabilities in ColdFusion, Experience Manager, DNG SDK, Acrobat Reader, and the Creative Cloud client. Fortinet has updated a number of products, including a fix for a critical authentication-bypass flaw in FortiCloud SSO. Google has published the Android December security bulletin, addressing two already exploited vulnerabilities. Ivanti has shipped updates including a CVSS 9.6 XSS fix in Ivanti Endpoint Manager. React has patched the critical React2Shell RCE flaw in React Server Components, already under active exploitation. SAP has corrected numerous issues, including a CVSS 9.9 code-injection vulnerability in SAP Solution Manager.
Administrators should prioritize installing updates that remediate the actively exploited CVE-2025-62221, the PowerShell issue CVE-2025-54100, and the GitHub Copilot flaw CVE-2025-64671, along with the critical Office and Outlook RCEs and updates for internet-facing servers (Exchange, SharePoint, RRAS). Once these are addressed, remaining Microsoft updates — as well as companion patches from other vendors — should be deployed in a structured rollout. The complete list of vulnerabilities and affected products is available in the official advisory.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
