Microsoft December 2021 Patch Tuesday fixes an actively exploited zero

HEVC Video Extensions Remote Code Execution Vulnerability

Windows Encrypting File System (EFS) Remote Code Execution Vulnerability

Microsoft Defender for IoT Remote Code Execution Vulnerability

Microsoft Office Graphics Remote Code Execution Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Web Media Extensions Remote Code Execution Vulnerability

Bot Framework SDK Remote Code Execution Vulnerability

CVE-2021-43226 is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) driver, a kernel-mode component that manages common log files. A local attacker who already has limited privileges on a machine (the CVSS vector requires only low privileges, no user interaction, and a local attack vector) can trigger the flaw through crafted interactions with the CLFS driver and escalate to full SYSTEM-level control of the host. CISA notes known use in ransomware campaigns, where this class of local privilege escalation is typically chained after initial access. Affected deployments span essentially all supported Windows client releases of the era: Windows 7, Windows 8.1 and Windows RT 8.1, Windows 10 versions 1507 through 21H2, and Windows 11 21H2. The bug was patched in Microsoft's December 2021 Patch Tuesday as an actively exploited zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with ransomware use noted, indicating demonstrated in-the-wild exploitation.

Do: Install the December 2021 Patch Tuesday (or any later) cumulative update for each affected release on all Windows 7, 8.1, Windows 10, and Windows 11 21H2 systems, and verify patch coverage through WSUS/Intune or equivalent inventory, per CISA KEV and BOD 22-01 guidance. Because this is a post-compromise privilege escalation used in ransomware chains, prioritize endpoints where low-privileged users can log in and hosts in ransomware-prone network segments.

VP9 Video Extensions Information Disclosure Vulnerability

Windows Digital TV Tuner Elevation of Privilege Vulnerability

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

Windows Mobile Device Management Elevation of Privilege Vulnerability

Visual Studio Code Remote Code Execution Vulnerability

Microsoft BizTalk ESB Toolkit Spoofing Vulnerability

Microsoft PowerShell Spoofing Vulnerability

Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability

Microsoft Office app Remote Code Execution Vulnerability

Visual Studio Code WSL Extension Remote Code Execution Vulnerability