Vulnerabilitycritical
Microsoft Patch Tuesday for December 2025 — Snort rules and prominent vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-59516+1 related CVE | Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally | 7.8 | 2% | ||
CVE-2025-62549+4 related CVEs | Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network | 8.8 group max | 1% | ||
| CVE-2025-62221 | Use-After-Free Local Privilege Escalation in Windows Cloud Files Mini Filter Driver | 7.8 | 3% | KEV | KEV |
| CVE-2025-62456 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network | 8.8 | 1% | ||
CVE-2025-62553+3 related CVEs | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally | 7.8 | <1% |
From the original article
3 min read at blog.talosintelligence.com
The Patch Tuesday for December of 2025 includes 57 vulnerabilities, including two that Microsoft marked as “critical.” The remaining vulnerabilities listed are classified as “important.” Microsoft assessed that exploitation of the two “critical” vulnerabilities is “less likely.”
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.