Microsoft Patches 57 Vulnerabilities in December 2025 Update

Microsoft released its final security update of 2025 on December 9, addressing 57 vulnerabilities across Windows operating systems, Office applications, and related components such as Exchange Server, Azure, Copilot, PowerShell, and Windows Defender. The cumulative update, known as KB5072033, includes patches for one actively exploited zero-day vulnerability that cybersecurity officials say poses an immediate risk to unpatched systems worldwide.

The most pressing issue fixed in the update is CVE-2025-62221, a use-after-free memory corruption flaw in the Windows Cloud Files Mini Filter Driver. This privilege escalation vulnerability, rated 7.8 on the CVSS severity scale, allows attackers with limited access to gain SYSTEM-level control over affected devices. Microsoft confirmed active exploitation in real-world attacks, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its catalog of known exploited vulnerabilities. "These types of bugs are often combined with a code execution bug to take over a system," said Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative. The flaw affects all supported versions of Windows, including Windows...