Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws

As we speak is Microsoft’s December 2025 Patch Tuesday, which fixes 57 flaws, together with one actively exploited and two publicly disclosed zero-day vulnerabilities.

This Patch Tuesday additionally addresses three “Essential” distant code execution vulnerabilities.

The variety of bugs in every vulnerability class is listed under:

• 28 Elevation of Privilege Vulnerabilities
• 19 Distant Code Execution Vulnerabilities
• 4 Info Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

When BleepingComputer stories on Patch Tuesday security updates, we solely depend these launched by Microsoft in the present day. Due to this fact, the variety of flaws doesn’t embrace Microsoft Edge (15 flaws) and Mariner vulnerabilities mounted earlier this month.

To study extra concerning the non-security updates launched in the present day, you’ll be able to evaluation our devoted articles on the Home windows 11 KB5072033 & KB5071417 cumulative updates.

3 zero-days, two exploited

This month’s Patch Tuesday fixes one actively exploited and two publicly disclosed zero-day vulnerabilities.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited whereas no official repair is out there.

The actively exploited zero-day is:

CVE-2025-62221 – Home windows Cloud Recordsdata Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft has patched an actively exploited privilege elevation vulnerability within the Home windows Cloud Recordsdata Mini Filter Driver. 

“Use after free in Home windows Cloud Recordsdata Mini Filter Driver permits a licensed attacker to raise privileges regionally,” explains Microsoft.

Microsoft says that efficiently exploiting the flaw permits attackers to realize SYSTEM privileges.

Microsoft has attributed the flaw to Microsoft Risk Intelligence Middle (MSTIC) & Microsoft Safety Response Middle (MSRC) however has not shared how the flaw was exploited.

The publicly disclosed zero-day flaws are:

CVE-2025-64671 – GitHub Copilot for Jetbrains Distant Code Execution Vulnerability

Microsoft has patched a publicly disclosed GitHub Copilot flaw that permits an attacker to execute instructions regionally.

“Improper neutralization of particular components utilized in a command (‘command injection’) in Copilot permits an unauthorized attacker to execute code regionally,” explains Microsoft.

Microsoft says the flaw will be exploited by a Cross Immediate Injection in untrusted information or MCP servers.

“Through a malicious Cross Immediate Inject in untrusted information or MCP servers, an attacker might execute further instructions by appending them to instructions allowed within the consumer’s terminal auto-approve setting,” continued Microsoft.

Microsoft has attributed the flaw to Ari Marzuk, who just lately disclosed the flaw as a part of his “IDEsaster: A Novel Vulnerability Class in AI IDEs” report.

CVE-2025-54100 – PowerShell Distant Code Execution Vulnerability

Microsoft has patched a PowerShell vulnerability that would trigger scripts embedded in a webpage to be executed when the web page is retrieved utilizing Invoke-WebRequest.

“Improper neutralization of particular components utilized in a command (‘command injection’) in Home windows PowerShell permits an unauthorized attacker to execute code regionally,” explains Microsoft.

Microsoft has made a change that shows a warning when PowerShell makes use of ‘Invoke-WebRequest,’ prompting the consumer so as to add the -UseBasicParsing to stop code execution.

Safety Warning: Script Execution Danger
Invoke-WebRequest parses the content material of the online web page. Script code within the net web page may be run when the web page is parsed.
      RECOMMENDED ACTION:
      Use the -UseBasicParsing change to keep away from script code execution.
      Do you need to proceed?
			```
 
For added particulars, see [KB5074596: PowerShell 5.1: Preventing script execution from web content](https://help.microsoft.com/assist/5072034).

Microsoft attributes this flaw to quite a few researchers, together with Justin Necke, DeadOverflow, Pēteris Hermanis Osipovs, Nameless, Melih Kaan Yıldız, and Osman Eren Güneş.

Current updates from different firms

Different distributors who launched updates or advisories in December 2025 embrace:

• Adobe launched security updates for ColdFusion, Expertise Supervisor, DNG SDK, Acrobat Reader, and Artistic Cloud Desktop.
• Fortinet launched security updates for a number of merchandise, together with a important FortiCloud SSO Login Authentication Bypass flaw.
• Google has launched Android’s December security bulletin, which incorporates fixes for 2 actively exploited vulnerabilities.
• Ivanti launched security patches as a part of its December 2025 Patch Tuesday updates, which embrace a repair for a 9.6/10 Saved XSS flaw in Ivanti Endpoint Supervisor.
• React launched security updates for a important RCE flaw in React Server Elements. The flaw, dubbed React2Shell, is now broadly exploited in assaults.
• SAP launched the December security updates for a number of merchandise, together with a repair for a 9.9/10 code injection flaw in SAP Answer Supervisor.

The December 2025 Patch Tuesday Safety Updates

Under is the entire listing of resolved vulnerabilities within the December 2025 Patch Tuesday updates.

To entry the complete description of every vulnerability and the methods it impacts, you’ll be able to view the full report right here.