Microsoft ends year with patch for exploited zero day

"The most pressing vulnerability on Microsoft's side is CVE-2025-62221. This is a problem in the Windows Cloud Files Mini Filter Driver with a CVSS score of 7.8. Microsoft confirms that this vulnerability has already been actively exploited. Although an attacker already needs access to the system, they can use this leak to obtain higher privileges and ultimately take complete control of the system."

"In addition to this zero-day vulnerability, there are two vulnerabilities that are publicly known, with no evidence of active exploitation as yet. CVE-2025-54100 concerns a problem in PowerShell that allows unauthorized code to be executed remotely. CVE-2025-64671 targets GitHub Copilot within JetBrains development environments and has a higher severity score. Although this vulnerability is formally classified as local, researchers point out that users can still be tricked into executing malicious commands."

"The risk in the latter category lies primarily in the combined use of AI functions and automatically approved commands. Malicious input in files or context sources can send additional instructions that are executed without additional confirmation. Security experts expect this type of attack to become more common in the future as AI tools become more deeply integrated into development environments."

Microsoft's December Patch Tuesday fixed an actively exploited Windows zero-day (CVE-2025-62221) and 56 other vulnerabilities across Windows and related products. CVE-2025-62221 affects the Windows Cloud Files Mini Filter Driver (CVSS 7.8) and enables privilege escalation from local access to complete system control. Two publicly disclosed flaws include CVE-2025-54100 (PowerShell remote code execution) and CVE-2025-64671 (GitHub Copilot in JetBrains, locally classified but exploitable via tricked users). AI integration and automatically approved commands can amplify risk by allowing malicious inputs to execute additional instructions without confirmation. Other vendors also released critical updates, increasing patching urgency.

Read at Techzine Global