CVE-2025-64671

—

CVSS 3.1

7.8 high

EPSS

<1%p29

Published

Dec 9, 2025 (Dec 9, 2025)

Modified

Jun 17, 2026

Description

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.

Vendors: microsoft
Products: github copilot
Weakness: CWE-77
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news4 stories

Microsoft Issues Security Fixes for 56 Flaws, Including Active Exploit and Two Zero

The Hacker NewsDec 10, 15:09 UTC · Dec 10, 2025Exploit / PoC in the wildCVE-2025-62223 CVE-2025-62221 CVE-2025-54100+6 CVEs

60

Microsoft Fixes Three Zero

Infosecurity MagazineDec 10, 09:45 UTC · Dec 10, 2025Exploit / PoC in the wildCVE-2025-62221 CVE-2025-54100 CVE-2025-64671+4 CVEs

60

Microsoft Patch Tuesday security updates for December 2025 fixed an actively exploited zero

Security AffairsDec 10, 08:47 UTC · Dec 10, 2025Vulnerability in the wildCVE-2025-62221 CVE-2025-64671 CVE-2025-54100

60

Microsoft Patch Tuesday, December 2025 Edition

Krebs on SecurityDec 10, 00:20 UTC · Dec 10, 2025Vulnerability in the wildCVE-2025-62221 CVE-2025-62554 CVE-2025-62557+8 CVEs

60