Active Exploitation of Windows Cloud Files Mini Filter Driver and WinRAR Vulnerabilities
Microsoft released security updates addressing 56 vulnerabilities across its Windows platform, including a critical use-after-free flaw in the Windows Cloud Files Mini Filter Driver (CVE-2025-62221) that has been actively exploited in the wild. This vulnerability allows local attackers to escalate privileges to SYSTEM level, posing a significant risk to Windows systems, especially those using cloud storage features like OneDrive, Google Drive, or iCloud. The December 2025 Patch Tuesday also included fixes for other critical and important vulnerabilities, with Microsoft having patched over 1,000 CVEs for the second consecutive year.
CISA has added both CVE-2025-62221 and CVE-2025-5618 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting their active exploitation and the urgent need for remediation. CVE-2025-5618 is a directory traversal remote code execution vulnerability in WinRAR, allowing attackers to craft malicious archives that bypass directory restrictions and execute arbitrary code upon extraction. Both vulnerabilities are being leveraged in real-world attacks, prompting federal agencies and organizations to prioritize patching to prevent persistence, lateral movement, and data exfiltration by threat actors.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft patches 56 flaws including exploited CVE-2025-62221
Microsoft released December 2025 security updates addressing 56 vulnerabilities across Windows, including the actively exploited zero-day CVE-2025-62221. The release also fixed two other zero-days, CVE-2025-54100 in PowerShell and CVE-2025-64671 affecting GitHub Copilot for JetBrains.
CISA adds CVE-2025-62221 to the KEV catalog
CISA added CVE-2025-62221, a Windows Cloud Files Mini Filter Driver use-after-free privilege escalation flaw, to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. A separate WinRAR flaw, CVE-2025-5618, was added at the same time, but it is outside the core Microsoft story.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft December Patch Tuesday Addresses Multiple Actively Exploited Vulnerabilities
Microsoft released its December Patch Tuesday updates, addressing a total of 57 CVEs, including several critical vulnerabilities that have been actively exploited. Among the most notable is CVE-2025-62221, a Windows Cloud Files Mini Filter Driver flaw rated 7.8 on the CVSS scale, which allows local privilege escalation if an attacker already has code execution on the system. Microsoft confirmed this vulnerability is being exploited as a zero-day, underscoring the urgency for organizations to apply the patch. Additional high-severity vulnerabilities include a PowerShell Remote Code Execution flaw (CVE-2025-54100) and a GitHub Copilot for Jetbrains bug (CVE-2025-64671), both of which are publicly known but not yet observed in active exploitation. Separately, Microsoft also issued a fix for CVE-2025-9491, a high-severity vulnerability in Windows LNK files that has been actively exploited by both state-sponsored and cybercriminal groups. This flaw enables attackers to embed malicious commands in shortcut files, facilitating malware deployment and persistent access to compromised systems. Security experts emphasize the importance of prioritizing these patches, as the vulnerabilities are being leveraged in real-world attacks and could lead to significant compromise if left unaddressed.
Mar 21, 2026
Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability (CVE-2025-62221)
Microsoft released a security update in December 2025 addressing a critical privilege escalation vulnerability in the Windows Cloud Files Mini Filter Driver, tracked as CVE-2025-62221. This flaw allows authenticated local attackers to elevate privileges to SYSTEM by exploiting a use-after-free condition in the kernel driver, which arises when the driver fails to reset a pointer after releasing a kernel object. The vulnerability has a CVSS score of 7.8 and has been actively exploited in the wild, prompting urgent patching recommendations from security researchers and vendors. The December 2025 Patch Tuesday included fixes for 57 vulnerabilities across Microsoft products, but CVE-2025-62221 was highlighted as one of the most severe due to its exploitation status and potential impact on enterprise environments. Security advisories emphasized the need for immediate patching, as the vulnerability was included in CISA's Known Exploited Vulnerabilities catalog and listed among the most exploited vulnerabilities of the year. Organizations are urged to apply the update promptly to mitigate the risk of privilege escalation attacks leveraging this flaw.
Mar 21, 2026
Microsoft December 2025 Patch Tuesday Addresses Zero-Days and 57 Vulnerabilities
Microsoft released its December 2025 Patch Tuesday updates, addressing 57 security vulnerabilities across its product suite, including three zero-day flaws. Among the most critical issues patched is CVE-2025-62221, an actively exploited elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver, which could allow attackers to gain SYSTEM privileges. The updates also include a fix for a remote code execution zero-day in PowerShell (CVE-2025-54100), which now prompts users with a security warning when using the `Invoke-WebRequest` command, and other critical vulnerabilities affecting Windows 10 and 11, as well as related server products. The updates are mandatory for supported systems, including those enrolled in the Extended Security Update (ESU) program, and require a system restart upon installation. CISA has added CVE-2025-62221 to its Known Exploited Vulnerabilities Catalog, urging all organizations to prioritize remediation due to evidence of active exploitation. Security advisories and technical analyses from multiple sources highlight the importance of promptly applying these patches, as the vulnerabilities present significant risks for privilege escalation and remote code execution. The December update also marks the continued support for Windows 10 through ESU, with no new features introduced, focusing solely on security and bug fixes. Organizations are advised to review the full list of addressed CVEs and ensure all relevant systems are updated to mitigate potential threats.
Mar 21, 2026