Microsoft’s December 2025 Patch Tuesday includes fixes for an actively exploited Windows vulnerability, according to multiple government and vulnerability tracking sources. The flaw, tracked as CVE-2025-62221, is a use-after-free issue in the Windows Cloud Files Mini Filter Driver that allows an authorized local attacker to elevate privileges.
The U.S. National Vulnerability Database describes the issue as a local privilege escalation vulnerability with low attack complexity and no required user interaction once an attacker has some level of access. The published CVSS v3.1 vector indicates high potential impact across confidentiality, integrity, and availability. The vulnerability has also been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, confirming it has been observed in real-world attacks.
Government advisories reinforce the risk. Canada’s Centre for Cyber Security states that Microsoft has received reports of active exploitation of CVE-2025-62221 and urges organizations and users to apply available updates. The advisory highlights that multiple Windows versions are affected, making this a broad endpoint security issue rather than a niche configuration problem.
From an identity and access management perspective, local privilege escalation vulnerabilities are often used as part of multi-stage attack chains. After initial access through phishing, malware, or stolen credentials, attackers can use flaws like CVE-2025-62221 to obtain SYSTEM-level privileges, enabling credential dumping, token theft, and persistent control of compromised devices. As a result, defenders typically prioritize rapid patch deployment, validation of endpoint update compliance, and heightened monitoring for suspicious activity on systems that have not yet been remediated.
Sources: NIST NVD, Canadian Centre for Cyber Security, CISA
—
By the ID Tech Editorial Team
