Microsoft December 2025 Patch Tuesday Fixes 56 Vulnerabilities Mounted and three Zero-days

CVE-2025-62554 Microsoft Workplace Distant Code Execution Vulnerability Essential Distant Code Execution Entry of useful resource utilizing incompatible kind (‘kind confusion’) in Microsoft Workplace permits an unauthorized attacker to execute code regionally. CVE-2025-62557 Microsoft Workplace Distant Code Execution Vulnerability Essential Distant Code Execution Use after free in Microsoft Workplace permits an unauthorized attacker to execute code regionally. CVE-2025-62454 Home windows Cloud Information Mini Filter Driver Elevation of Privilege Vulnerability Essential Elevation of Privilege Heap-based buffer overflow in Home windows Cloud Information Mini Filter Driver permits a licensed attacker to raise privileges regionally. CVE-2025-62456 Home windows Resilient File System (ReFS) Distant Code Execution Vulnerability Essential Distant Code Execution Heap-based buffer overflow in Home windows Resilient File System (ReFS) permits a licensed attacker to execute code over a community. CVE-2025-62457 Home windows Cloud Information Mini Filter Driver Elevation of Privilege Vulnerability Essential Elevation of Privilege Out-of-bounds learn in Home windows Cloud Information Mini Filter Driver permits a licensed attacker to raise privileges regionally. CVE-2025-62458 Win32k Elevation of Privilege Vulnerability Essential Elevation of Privilege Heap-based buffer overflow in Home windows Win32K – GRFX permits a licensed attacker to raise privileges regionally. CVE-2025-62466 Home windows Consumer-Facet Caching Elevation of Privilege Vulnerability Essential Elevation of Privilege Null pointer dereference in Home windows Consumer-Facet Caching (CSC) Service permits a licensed attacker to raise privileges regionally. CVE-2025-62469 Microsoft Brokering File System Elevation of Privilege Vulnerability Essential Elevation of Privilege Concurrent execution utilizing shared useful resource with improper synchronization (‘race situation’) in Microsoft Brokering File System permits a licensed attacker to raise privileges regionally. CVE-2025-62470 Home windows Widespread Log File System Driver Elevation of Privilege Vulnerability Essential Elevation of Privilege Heap-based buffer overflow in Home windows Widespread Log File System Driver permits a licensed attacker to raise privileges regionally. CVE-2025-62472 Home windows Distant Entry Connection Supervisor Elevation of Privilege Vulnerability Essential Elevation of Privilege Use of uninitialized useful resource in Home windows Distant Entry Connection Supervisor permits a licensed attacker to raise privileges regionally. CVE-2025-62473 Home windows Routing and Distant Entry Service (RRAS) Data Disclosure Vulnerability Essential Data Disclosure Buffer over-read in Home windows Routing and Distant Entry Service (RRAS) permits an unauthorized attacker to reveal data over a community. CVE-2025-62549 Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability Essential Distant Code Execution Untrusted pointer dereference in Home windows Routing and Distant Entry Service (RRAS) permits an unauthorized attacker to execute code over a community. CVE-2025-62561 Microsoft Excel Distant Code Execution Vulnerability Essential Distant Code Execution Untrusted pointer dereference in Microsoft Workplace Excel permits an unauthorized attacker to execute code regionally. CVE-2025-62562 Microsoft Outlook Distant Code Execution Vulnerability Essential Distant Code Execution Use after free in Microsoft Workplace Outlook permits an unauthorized attacker to execute code regionally. CVE-2025-62563 Microsoft Excel Distant Code Execution Vulnerability Essential Distant Code Execution Use after free in Microsoft Workplace Excel permits an unauthorized attacker to execute code regionally. CVE-2025-62564 Microsoft Excel Distant Code Execution Vulnerability Essential Distant Code Execution Out-of-bounds learn in Microsoft Workplace Excel permits an unauthorized attacker to execute code regionally. CVE-2025-62571 Home windows Installer Elevation of Privilege Vulnerability Essential Elevation of Privilege Improper enter validation in Home windows Installer permits a licensed attacker to raise privileges regionally. CVE-2025-62572 Software Data Service Elevation of Privilege Vulnerability Essential Elevation of Privilege Out-of-bounds learn in Software Data Companies permits a licensed attacker to raise privileges regionally. CVE-2025-62573 DirectX Graphics Kernel Elevation of Privilege Vulnerability Essential Elevation of Privilege Use after free in Home windows DirectX permits a licensed attacker to raise privileges regionally. CVE-2025-64658 Home windows File Explorer Elevation of Privilege Vulnerability Essential Elevation of Privilege Concurrent execution utilizing shared useful resource with improper synchronization (‘race situation’) in Home windows Shell permits a licensed attacker to raise privileges regionally. CVE-2025-64667 Microsoft Trade Server Spoofing Vulnerability Essential Spoofing Consumer interface (ui) misrepresentation of crucial data in Microsoft Trade Server permits an unauthorized attacker to carry out spoofing over a community. CVE-2025-64666 Microsoft Trade Server Elevation of Privilege Vulnerability Essential Elevation of Privilege Improper enter validation in Microsoft Trade Server permits a licensed attacker to raise privileges over a community. CVE-2025-64670 Home windows DirectX Data Disclosure Vulnerability Essential Data Disclosure Publicity of delicate data to an unauthorized actor in Microsoft Graphics Part permits a licensed attacker to reveal data over a community. CVE-2025-64673 Home windows Storage VSP Driver Elevation of Privilege Vulnerability Essential Elevation of Privilege Improper entry management in Storvsp.sys Driver permits a licensed attacker to raise privileges regionally. CVE-2025-59516 Home windows Storage VSP Driver Elevation of Privilege Vulnerability Essential Elevation of Privilege Lacking authentication for crucial operate in Home windows Storage VSP Driver permits a licensed attacker to raise privileges regionally. CVE-2025-59517 Home windows Storage VSP Driver Elevation of Privilege Vulnerability Essential Elevation of Privilege Improper entry management in Home windows Storage VSP Driver permits a licensed attacker to raise privileges regionally. CVE-2025-62455 Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability Essential Elevation of Privilege Improper enter validation in Home windows Message Queuing permits a licensed attacker to raise privileges regionally. CVE-2025-62461 Home windows Projected File System Elevation of Privilege Vulnerability Essential Elevation of Privilege Buffer over-read in Home windows Projected File System Filter Driver permits a licensed attacker to raise privileges regionally. CVE-2025-62463 DirectX Graphics Kernel Denial of Service Vulnerability Essential Denial of Service Null pointer dereference in Home windows DirectX permits a licensed attacker to disclaim service regionally. CVE-2025-62462 Home windows Projected File System Elevation of Privilege Vulnerability Essential Elevation of Privilege Buffer over-read in Home windows Projected File System permits a licensed attacker to raise privileges regionally. CVE-2025-62464 Home windows Projected File System Elevation of Privilege Vulnerability Essential Elevation of Privilege Buffer over-read in Home windows Projected File System permits a licensed attacker to raise privileges regionally. CVE-2025-62465 DirectX Graphics Kernel Denial of Service Vulnerability Essential Denial of Service Null pointer dereference in Home windows DirectX permits a licensed attacker to disclaim service regionally. CVE-2025-55233 Home windows Projected File System Elevation of Privilege Vulnerability Essential Elevation of Privilege Out-of-bounds learn in Home windows Projected File System permits a licensed attacker to raise privileges regionally. CVE-2025-62467 Home windows Projected File System Elevation of Privilege Vulnerability Essential Elevation of Privilege Integer overflow or wraparound in Home windows Projected File System permits a licensed attacker to raise privileges regionally. CVE-2025-62468 Home windows Defender Firewall Service Data Disclosure Vulnerability Essential Data Disclosure Out-of-bounds learn in Home windows Defender Firewall Service permits a licensed attacker to reveal data regionally. CVE-2025-62474 Home windows Distant Entry Connection Supervisor Elevation of Privilege Vulnerability Essential Elevation of Privilege Improper entry management in Home windows Distant Entry Connection Supervisor permits a licensed attacker to raise privileges regionally. CVE-2025-62550 Azure Monitor Agent Distant Code Execution Vulnerability Essential Distant Code Execution Out-of-bounds write in Azure Monitor Agent permits a licensed attacker to execute code over a community. CVE-2025-62552 Microsoft Entry Distant Code Execution Vulnerability Essential Distant Code Execution Relative path traversal in Microsoft Workplace Entry permits an unauthorized attacker to execute code regionally. CVE-2025-62553 Microsoft Excel Distant Code Execution Vulnerability Essential Distant Code Execution Use after free in Microsoft Workplace Excel permits an unauthorized attacker to execute code regionally. CVE-2025-62555 Microsoft Phrase Distant Code Execution Vulnerability Essential Distant Code Execution Use after free in Microsoft Workplace Phrase permits an unauthorized attacker to execute code regionally. CVE-2025-62556 Microsoft Excel Distant Code Execution Vulnerability Essential Distant Code Execution Untrusted pointer dereference in Microsoft Workplace Excel permits an unauthorized attacker to execute code regionally. CVE-2025-62558 Microsoft Phrase Distant Code Execution Vulnerability Essential Distant Code Execution Use after free in Microsoft Workplace Phrase permits an unauthorized attacker to execute code regionally. CVE-2025-62559 Microsoft Phrase Distant Code Execution Vulnerability Essential Distant Code Execution Use after free in Microsoft Workplace Phrase permits an unauthorized attacker to execute code regionally. CVE-2025-62560 Microsoft Excel Distant Code Execution Vulnerability Essential Distant Code Execution Untrusted pointer dereference in Microsoft Workplace Excel permits an unauthorized attacker to execute code regionally. CVE-2025-62567 Home windows Hyper-V Denial of Service Vulnerability Essential Denial of Service Integer underflow (wrap or wraparound) in Home windows Hyper-V permits a licensed attacker to disclaim service over a community. CVE-2025-62569 Microsoft Brokering File System Elevation of Privilege Vulnerability Essential Elevation of Privilege Use after free in Microsoft Brokering File System permits a licensed attacker to raise privileges regionally. CVE-2025-62570 Home windows Digicam Body Server Monitor Data Disclosure Vulnerability Essential Data Disclosure Improper entry management in Home windows Digicam Body Server Monitor permits a licensed attacker to reveal data regionally. CVE-2025-62565 Home windows File Explorer Elevation of Privilege Vulnerability Essential Elevation of Privilege Use after free in Home windows Shell permits a licensed attacker to raise privileges regionally. CVE-2025-64661 Home windows Shell Elevation of Privilege Vulnerability Essential Elevation of Privilege Concurrent execution utilizing shared useful resource with improper synchronization (‘race situation’) in Home windows Shell permits a licensed attacker to raise privileges regionally. CVE-2025-64671 GitHub Copilot for Jetbrains Distant Code Execution Vulnerability Essential Distant Code Execution Improper neutralization of particular components utilized in a command (‘command injection’) in Copilot permits an unauthorized attacker to execute code regionally. CVE-2025-64672 Microsoft SharePoint Server Spoofing Vulnerability Essential Spoofing Improper neutralization of enter throughout net web page technology (‘cross-site scripting’) in Microsoft Workplace SharePoint permits a licensed attacker to carry out spoofing over a community. CVE-2025-64678 Home windows Routing and Distant Entry Service (RRAS) Distant Code Execution Vulnerability Essential Distant Code Execution Heap-based buffer overflow in Home windows Routing and Distant Entry Service (RRAS) permits an unauthorized attacker to execute code over a community. CVE-2025-64679 Home windows DWM Core Library Elevation of Privilege Vulnerability Essential Elevation of Privilege Heap-based buffer overflow in Home windows DWM Core Library permits a licensed attacker to raise privileges regionally. CVE-2025-64680 Home windows DWM Core Library Elevation of Privilege Vulnerability Essential Elevation of Privilege Heap-based buffer overflow in Home windows DWM Core Library permits a licensed attacker to raise privileges regionally. CVE-2025-54100 PowerShell Distant Code Execution Vulnerability Essential Distant Code Execution Improper neutralization of particular components utilized in a command (‘command injection’) in Home windows PowerShell permits an unauthorized attacker to execute code regionally. CVE-2025-62221 Home windows Cloud Information Mini Filter Driver Elevation of Privilege Vulnerability Essential Elevation of Privilege Use after free in Home windows Cloud Information Mini Filter Driver permits a licensed attacker to raise privileges regionally.