Microsoft Addresses 56 Security Flaws, Including Active Exploit and Two Zero-Days

Key Findings

• Microsoft released patches for 56 security vulnerabilities in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild.

• Of the 56 flaws, three are rated Critical, and 53 are rated Important in severity.

• Two of the patched vulnerabilities are listed as publicly known at the time of the release.

• The vulnerabilities include 29 privilege escalation, 18 remote code execution, four information disclosure, three denial-of-service, and two spoofing vulnerabilities.

• Microsoft has addressed a total of 1,275 CVEs in 2025, marking the second consecutive year where the Windows maker has patched over 1,000 CVEs.

Background

Microsoft closed out 2025 with patches for 56 security flaws in various products across the Windows platform, including one vulnerability that has been actively exploited in the wild. The update is in addition to 17 shortcomings the tech giant patched in its Chromium-based Edge browser since the release of the November 2025 Patch Tuesday update.

Actively Exploited Vulnerability

The vulnerability that has come under active exploitation is CVE-2025-62221 (CVSS score: 7.8), a use-after-free in Windows Cloud Files Mini Filter Driver that could allow an authorized attacker to elevate privileges locally and obtain SYSTEM permissions. The exploitation of CVE-2025-62221 has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to the Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to apply the patch by December 30, 2025.

Zero-Day Vulnerabilities

The remaining two zero-days are:

• CVE-2025-54100 (CVSS score: 7.8) - A command injection vulnerability in Windows PowerShell that allows an unauthorized attacker to execute code locally

• CVE-2025-64671 (CVSS score: 8.4) - A command injection vulnerability in GitHub Copilot for JetBrains that allows an unauthorized attacker to execute code locally

Impact and Exploitation

The exploitation of CVE-2025-62221 could allow an attacker to gain low-privileged access through methods like phishing, web browser exploits, or another known remote code execution flaw, and then chain it with CVE-2025-62221 to seize control of the host. Armed with this access, the attacker could deploy kernel components or abuse signed drivers to evade defenses and maintain persistence, and can be weaponized to achieve a domain-wide compromise when coupled with credential theft scenarios.

The PowerShell vulnerability, CVE-2025-54100, is a command injection flaw that lets an unauthenticated attacker execute arbitrary code in the security context of a user who runs a crafted PowerShell command, such as Invoke-WebRequest.

The GitHub Copilot vulnerability, CVE-2025-64671, is a critical Remote Code Execution (RCE) flaw that could allow an unauthenticated attacker to execute code remotely, effectively turning the developer's assistant into a potential saboteur.

Sources

• https://thehackernews.com/2025/12/microsoft-issues-security-fixes-for-56.html

• https://securityonline.info/microsoft-patches-three-zero-days-including-active-cloud-files-uaf-to-system-and-copilot-rce/