Microsoft Patch Tuesday for December 2025 — Snort rules and prominent vulnerabilities

Key Findings

• Microsoft released 57 vulnerabilities in the December 2025 Patch Tuesday, including 2 "critical" and the rest "important"

• Microsoft assessed that exploitation of the 2 "critical" vulnerabilities is "less likely"

• Cisco Talos is releasing new Snort rules to detect attempts to exploit some of the disclosed vulnerabilities

Background

This month's Patch Tuesday addresses a range of vulnerabilities, including:

• CVE-2025-62562: Microsoft Outlook remote code execution vulnerability

• CVE-2025-62553, CVE-2025-62554, CVE-2025-62556, CVE-2025-62557: Microsoft Office Remote Code Execution Vulnerabilities

• CVE-2025-62456: Remote Code Execution Vulnerability in Windows Resilient File System (ReFS)

• CVE-2025-62549: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

• CVE-2025-62565, CVE-2025-64661: Windows Shell elevation-of-privilege vulnerabilities

Vulnerabilities More Likely to be Exploited

Cisco Talos would also like to highlight several vulnerabilities that are only rated as "important," but Microsoft lists as "more likely" to be exploited:

• CVE-2025-62454 - Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

• CVE-2025-62458 - Win32k Elevation of Privilege Vulnerability

• CVE-2025-62470 - Windows Common Log File System Driver Elevation of Privilege Vulnerability

• CVE-2025-62472 - Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

• CVE-2025-59516 and CVE-2025-59517 - Windows Storage VSP Driver Elevation of Privilege Vulnerability

• CVE-2025-62221 - Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Snort Rules

In response to these vulnerability disclosures, Talos is releasing a new Snort rule set that detects attempts to exploit some of them. The rules included in this release that protect against the exploitation of many of these vulnerabilities are:

• 62486, 62487, 65555-65562, 65571-65574

• 300719, 301351-301354, 301356, 301357

Sources

• https://blog.talosintelligence.com/microsoft-patch-tuesday-december-2025/

• https://krebsonsecurity.com/2025/12/microsoft-patch-tuesday-december-2025-edition/

• https://www.reddit.com/r/SecOpsDaily/comments/1pinltv/microsoft_patch_tuesday_for_december_2025_snort/