Microsoft December 2025 Patch Tuesday Fixes 56 Vulnerabilities Mounted and three Zero-days

CVE-2025-62554 Microsoft Workplace Distant Code Execution Vulnerability Vital Distant Code Execution Entry of useful resource utilizing incompatible kind (‘kind confusion’) in Microsoft Workplace permits an unauthorized attacker to execute code domestically. CVE-2025-62557 Microsoft Workplace Distant Code Execution Vulnerability Vital Distant Code Execution Use after free in Microsoft Workplace permits an unauthorized attacker to execute code domestically. CVE-2025-62454 Home windows Cloud Information Mini Filter Driver Elevation of Privilege Vulnerability Necessary Elevation of Privilege Heap-based buffer overflow in Home windows Cloud Information Mini Filter Driver permits a certified attacker to raise privileges domestically. CVE-2025-62456 Home windows Resilient File System (ReFS) Distant Code Execution Vulnerability Necessary Distant Code Execution Heap-based buffer overflow in Home windows Resilient File System (ReFS) permits a certified attacker to execute code over a community. CVE-2025-62457 Home windows Cloud Information Mini Filter Driver Elevation of Privilege Vulnerability Necessary Elevation of Privilege Out-of-bounds learn in Home windows Cloud Information Mini Filter Driver permits a certified attacker to raise privileges domestically. CVE-2025-62458 Win32k Elevation of Privilege Vulnerability Necessary Elevation of Privilege Heap-based buffer overflow in Home windows Win32K – GRFX permits a certified attacker to raise privileges domestically. CVE-2025-62466 Home windows Shopper-Facet Caching Elevation of Privilege Vulnerability Necessary Elevation of Privilege Null pointer dereference in Home windows Shopper-Facet Caching (CSC) Service permits a certified attacker to raise privileges domestically. CVE-2025-62469 Microsoft Brokering File System Elevation of Privilege Vulnerability Necessary Elevation of Privilege Concurrent execution utilizing shared useful resource with improper synchronization (‘race situation’) in Microsoft Brokering File System permits a certified attacker to raise privileges domestically. CVE-2025-62470 Home windows Frequent Log File System Driver Elevation of Privilege Vulnerability Necessary Elevation of Privilege Heap-based buffer overflow in Home windows Frequent Log File System Driver permits a certified attacker to raise privileges domestically. CVE-2025-62472 Home windows Distant Entry Connection Supervisor Elevation of Privilege Vulnerability Necessary Elevation of Privilege Use of uninitialized useful resource in Home windows Distant Entry Connection Supervisor permits a certified attacker to raise privileges domestically. CVE-2025-62473 Home windows Routing and Distant Entry Service (RRAS) Info Disclosure Vulnerability Necessary Info Disclosure Buffer over-read in Home windows Routing and Distant Entry Service (RRAS) permits an unauthorized attacker to reveal data over a community. CVE-2025-62549 Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability Necessary Distant Code Execution Untrusted pointer dereference in Home windows Routing and Distant Entry Service (RRAS) permits an unauthorized attacker to execute code over a community. CVE-2025-62561 Microsoft Excel Distant Code Execution Vulnerability Necessary Distant Code Execution Untrusted pointer dereference in Microsoft Workplace Excel permits an unauthorized attacker to execute code domestically. CVE-2025-62562 Microsoft Outlook Distant Code Execution Vulnerability Necessary Distant Code Execution Use after free in Microsoft Workplace Outlook permits an unauthorized attacker to execute code domestically. CVE-2025-62563 Microsoft Excel Distant Code Execution Vulnerability Necessary Distant Code Execution Use after free in Microsoft Workplace Excel permits an unauthorized attacker to execute code domestically. CVE-2025-62564 Microsoft Excel Distant Code Execution Vulnerability Necessary Distant Code Execution Out-of-bounds learn in Microsoft Workplace Excel permits an unauthorized attacker to execute code domestically. CVE-2025-62571 Home windows Installer Elevation of Privilege Vulnerability Necessary Elevation of Privilege Improper enter validation in Home windows Installer permits a certified attacker to raise privileges domestically. CVE-2025-62572 Software Info Service Elevation of Privilege Vulnerability Necessary Elevation of Privilege Out-of-bounds learn in Software Info Providers permits a certified attacker to raise privileges domestically. CVE-2025-62573 DirectX Graphics Kernel Elevation of Privilege Vulnerability Necessary Elevation of Privilege Use after free in Home windows DirectX permits a certified attacker to raise privileges domestically. CVE-2025-64658 Home windows File Explorer Elevation of Privilege Vulnerability Necessary Elevation of Privilege Concurrent execution utilizing shared useful resource with improper synchronization (‘race situation’) in Home windows Shell permits a certified attacker to raise privileges domestically. CVE-2025-64667 Microsoft Alternate Server Spoofing Vulnerability Necessary Spoofing Person interface (ui) misrepresentation of essential data in Microsoft Alternate Server permits an unauthorized attacker to carry out spoofing over a community. CVE-2025-64666 Microsoft Alternate Server Elevation of Privilege Vulnerability Necessary Elevation of Privilege Improper enter validation in Microsoft Alternate Server permits a certified attacker to raise privileges over a community. CVE-2025-64670 Home windows DirectX Info Disclosure Vulnerability Necessary Info Disclosure Publicity of delicate data to an unauthorized actor in Microsoft Graphics Element permits a certified attacker to reveal data over a community. CVE-2025-64673 Home windows Storage VSP Driver Elevation of Privilege Vulnerability Necessary Elevation of Privilege Improper entry management in Storvsp.sys Driver permits a certified attacker to raise privileges domestically. CVE-2025-59516 Home windows Storage VSP Driver Elevation of Privilege Vulnerability Necessary Elevation of Privilege Lacking authentication for essential operate in Home windows Storage VSP Driver permits a certified attacker to raise privileges domestically. CVE-2025-59517 Home windows Storage VSP Driver Elevation of Privilege Vulnerability Necessary Elevation of Privilege Improper entry management in Home windows Storage VSP Driver permits a certified attacker to raise privileges domestically. CVE-2025-62455 Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability Necessary Elevation of Privilege Improper enter validation in Home windows Message Queuing permits a certified attacker to raise privileges domestically. CVE-2025-62461 Home windows Projected File System Elevation of Privilege Vulnerability Necessary Elevation of Privilege Buffer over-read in Home windows Projected File System Filter Driver permits a certified attacker to raise privileges domestically. CVE-2025-62463 DirectX Graphics Kernel Denial of Service Vulnerability Necessary Denial of Service Null pointer dereference in Home windows DirectX permits a certified attacker to disclaim service domestically. CVE-2025-62462 Home windows Projected File System Elevation of Privilege Vulnerability Necessary Elevation of Privilege Buffer over-read in Home windows Projected File System permits a certified attacker to raise privileges domestically. CVE-2025-62464 Home windows Projected File System Elevation of Privilege Vulnerability Necessary Elevation of Privilege Buffer over-read in Home windows Projected File System permits a certified attacker to raise privileges domestically. CVE-2025-62465 DirectX Graphics Kernel Denial of Service Vulnerability Necessary Denial of Service Null pointer dereference in Home windows DirectX permits a certified attacker to disclaim service domestically. CVE-2025-55233 Home windows Projected File System Elevation of Privilege Vulnerability Necessary Elevation of Privilege Out-of-bounds learn in Home windows Projected File System permits a certified attacker to raise privileges domestically. CVE-2025-62467 Home windows Projected File System Elevation of Privilege Vulnerability Necessary Elevation of Privilege Integer overflow or wraparound in Home windows Projected File System permits a certified attacker to raise privileges domestically. CVE-2025-62468 Home windows Defender Firewall Service Info Disclosure Vulnerability Necessary Info Disclosure Out-of-bounds learn in Home windows Defender Firewall Service permits a certified attacker to reveal data domestically. CVE-2025-62474 Home windows Distant Entry Connection Supervisor Elevation of Privilege Vulnerability Necessary Elevation of Privilege Improper entry management in Home windows Distant Entry Connection Supervisor permits a certified attacker to raise privileges domestically. CVE-2025-62550 Azure Monitor Agent Distant Code Execution Vulnerability Necessary Distant Code Execution Out-of-bounds write in Azure Monitor Agent permits a certified attacker to execute code over a community. CVE-2025-62552 Microsoft Entry Distant Code Execution Vulnerability Necessary Distant Code Execution Relative path traversal in Microsoft Workplace Entry permits an unauthorized attacker to execute code domestically. CVE-2025-62553 Microsoft Excel Distant Code Execution Vulnerability Necessary Distant Code Execution Use after free in Microsoft Workplace Excel permits an unauthorized attacker to execute code domestically. CVE-2025-62555 Microsoft Phrase Distant Code Execution Vulnerability Necessary Distant Code Execution Use after free in Microsoft Workplace Phrase permits an unauthorized attacker to execute code domestically. CVE-2025-62556 Microsoft Excel Distant Code Execution Vulnerability Necessary Distant Code Execution Untrusted pointer dereference in Microsoft Workplace Excel permits an unauthorized attacker to execute code domestically. CVE-2025-62558 Microsoft Phrase Distant Code Execution Vulnerability Necessary Distant Code Execution Use after free in Microsoft Workplace Phrase permits an unauthorized attacker to execute code domestically. CVE-2025-62559 Microsoft Phrase Distant Code Execution Vulnerability Necessary Distant Code Execution Use after free in Microsoft Workplace Phrase permits an unauthorized attacker to execute code domestically. CVE-2025-62560 Microsoft Excel Distant Code Execution Vulnerability Necessary Distant Code Execution Untrusted pointer dereference in Microsoft Workplace Excel permits an unauthorized attacker to execute code domestically. CVE-2025-62567 Home windows Hyper-V Denial of Service Vulnerability Necessary Denial of Service Integer underflow (wrap or wraparound) in Home windows Hyper-V permits a certified attacker to disclaim service over a community. CVE-2025-62569 Microsoft Brokering File System Elevation of Privilege Vulnerability Necessary Elevation of Privilege Use after free in Microsoft Brokering File System permits a certified attacker to raise privileges domestically. CVE-2025-62570 Home windows Digicam Body Server Monitor Info Disclosure Vulnerability Necessary Info Disclosure Improper entry management in Home windows Digicam Body Server Monitor permits a certified attacker to reveal data domestically. CVE-2025-62565 Home windows File Explorer Elevation of Privilege Vulnerability Necessary Elevation of Privilege Use after free in Home windows Shell permits a certified attacker to raise privileges domestically. CVE-2025-64661 Home windows Shell Elevation of Privilege Vulnerability Necessary Elevation of Privilege Concurrent execution utilizing shared useful resource with improper synchronization (‘race situation’) in Home windows Shell permits a certified attacker to raise privileges domestically. CVE-2025-64671 GitHub Copilot for Jetbrains Distant Code Execution Vulnerability Necessary Distant Code Execution Improper neutralization of particular parts utilized in a command (‘command injection’) in Copilot permits an unauthorized attacker to execute code domestically. CVE-2025-64672 Microsoft SharePoint Server Spoofing Vulnerability Necessary Spoofing Improper neutralization of enter throughout net web page technology (‘cross-site scripting’) in Microsoft Workplace SharePoint permits a certified attacker to carry out spoofing over a community. CVE-2025-64678 Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability Necessary Distant Code Execution Heap-based buffer overflow in Home windows Routing and Distant Entry Service (RRAS) permits an unauthorized attacker to execute code over a community. CVE-2025-64679 Home windows DWM Core Library Elevation of Privilege Vulnerability Necessary Elevation of Privilege Heap-based buffer overflow in Home windows DWM Core Library permits a certified attacker to raise privileges domestically. CVE-2025-64680 Home windows DWM Core Library Elevation of Privilege Vulnerability Necessary Elevation of Privilege Heap-based buffer overflow in Home windows DWM Core Library permits a certified attacker to raise privileges domestically. CVE-2025-54100 PowerShell Distant Code Execution Vulnerability Necessary Distant Code Execution Improper neutralization of particular parts utilized in a command (‘command injection’) in Home windows PowerShell permits an unauthorized attacker to execute code domestically. CVE-2025-62221 Home windows Cloud Information Mini Filter Driver Elevation of Privilege Vulnerability Necessary Elevation of Privilege Use after free in Home windows Cloud Information Mini Filter Driver permits a certified attacker to raise privileges domestically.