Microsoft Patch Tuesday, December 2025 Edition
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-59517+4 related CVEs | Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally | 7.8 | 2% | ||
| CVE-2025-59516 | Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally | 7.8 | 2% | ||
| CVE-2025-62221 | Use-After-Free Local Privilege Escalation in Windows Cloud Files Mini Filter Driver | 7.8 | 3% | KEV | KEV |
CVE-2025-62562+2 related CVEs | Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally | 7.8 | <1% | ||
| CVE-2025-64671 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally | 7.8 | <1% |
From the original article
3 min read at krebsonsecurity.comMicrosoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already being exploited, as well as two publicly disclosed vulnerabilities. Despite releasing a lower-than-normal number of security updates these past few months, Microsoft patched a whopping 1,129 vulnerabilities in 2025, an 11.
krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.