Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability (CVE-2025-62221)
Microsoft released a security update in December 2025 addressing a critical privilege escalation vulnerability in the Windows Cloud Files Mini Filter Driver, tracked as CVE-2025-62221. This flaw allows authenticated local attackers to elevate privileges to SYSTEM by exploiting a use-after-free condition in the kernel driver, which arises when the driver fails to reset a pointer after releasing a kernel object. The vulnerability has a CVSS score of 7.8 and has been actively exploited in the wild, prompting urgent patching recommendations from security researchers and vendors.
The December 2025 Patch Tuesday included fixes for 57 vulnerabilities across Microsoft products, but CVE-2025-62221 was highlighted as one of the most severe due to its exploitation status and potential impact on enterprise environments. Security advisories emphasized the need for immediate patching, as the vulnerability was included in CISA's Known Exploited Vulnerabilities catalog and listed among the most exploited vulnerabilities of the year. Organizations are urged to apply the update promptly to mitigate the risk of privilege escalation attacks leveraging this flaw.
Related Entities
Vulnerabilities
Threat Actors
Sources
Related Stories
Active Exploitation of Windows Cloud Files Mini Filter Driver and WinRAR Vulnerabilities
Microsoft released security updates addressing 56 vulnerabilities across its Windows platform, including a critical use-after-free flaw in the Windows Cloud Files Mini Filter Driver (CVE-2025-62221) that has been actively exploited in the wild. This vulnerability allows local attackers to escalate privileges to SYSTEM level, posing a significant risk to Windows systems, especially those using cloud storage features like OneDrive, Google Drive, or iCloud. The December 2025 Patch Tuesday also included fixes for other critical and important vulnerabilities, with Microsoft having patched over 1,000 CVEs for the second consecutive year. CISA has added both CVE-2025-62221 and CVE-2025-5618 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting their active exploitation and the urgent need for remediation. CVE-2025-5618 is a directory traversal remote code execution vulnerability in WinRAR, allowing attackers to craft malicious archives that bypass directory restrictions and execute arbitrary code upon extraction. Both vulnerabilities are being leveraged in real-world attacks, prompting federal agencies and organizations to prioritize patching to prevent persistence, lateral movement, and data exfiltration by threat actors.
3 months agoMicrosoft December 2025 Patch Tuesday Addresses Zero-Days and 57 Vulnerabilities
Microsoft released its December 2025 Patch Tuesday updates, addressing 57 security vulnerabilities across its product suite, including three zero-day flaws. Among the most critical issues patched is CVE-2025-62221, an actively exploited elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver, which could allow attackers to gain SYSTEM privileges. The updates also include a fix for a remote code execution zero-day in PowerShell (CVE-2025-54100), which now prompts users with a security warning when using the `Invoke-WebRequest` command, and other critical vulnerabilities affecting Windows 10 and 11, as well as related server products. The updates are mandatory for supported systems, including those enrolled in the Extended Security Update (ESU) program, and require a system restart upon installation. CISA has added CVE-2025-62221 to its Known Exploited Vulnerabilities Catalog, urging all organizations to prioritize remediation due to evidence of active exploitation. Security advisories and technical analyses from multiple sources highlight the importance of promptly applying these patches, as the vulnerabilities present significant risks for privilege escalation and remote code execution. The December update also marks the continued support for Windows 10 through ESU, with no new features introduced, focusing solely on security and bug fixes. Organizations are advised to review the full list of addressed CVEs and ensure all relevant systems are updated to mitigate potential threats.
3 months agoMicrosoft December Patch Tuesday Addresses Multiple Actively Exploited Vulnerabilities
Microsoft released its December Patch Tuesday updates, addressing a total of 57 CVEs, including several critical vulnerabilities that have been actively exploited. Among the most notable is CVE-2025-62221, a Windows Cloud Files Mini Filter Driver flaw rated 7.8 on the CVSS scale, which allows local privilege escalation if an attacker already has code execution on the system. Microsoft confirmed this vulnerability is being exploited as a zero-day, underscoring the urgency for organizations to apply the patch. Additional high-severity vulnerabilities include a PowerShell Remote Code Execution flaw (CVE-2025-54100) and a GitHub Copilot for Jetbrains bug (CVE-2025-64671), both of which are publicly known but not yet observed in active exploitation. Separately, Microsoft also issued a fix for CVE-2025-9491, a high-severity vulnerability in Windows LNK files that has been actively exploited by both state-sponsored and cybercriminal groups. This flaw enables attackers to embed malicious commands in shortcut files, facilitating malware deployment and persistent access to compromised systems. Security experts emphasize the importance of prioritizing these patches, as the vulnerabilities are being leveraged in real-world attacks and could lead to significant compromise if left unaddressed.
3 months ago