What’s New Wednesday: December 2015 December 10, 2025 – Posted in: IT Support, What's New Wednesdays – Tags: Cyber Security, ITSupport, Patch Tuesday, patching, WhatsNewWednesday
Welcome to the last Patch Tuesday of 2025. Yes, it’s December already. Merry Christmas, Season’s Greetings, Happy Holidays and an excellent New Year to you all, I’m sure you’ll be delighted to hear what Microsoft has for your stockings this year – 57 flaws were patched including 1 actively exploited and 2 zero-day vulnerabilities. It’s a good idea to restart your PC today, and we may restart some of your servers overnight this week if a patch requires it.
NEW THIS WEDNESDAY
Overall Microsoft patched:
- 28 Elevation of Privilege Vulnerabilities
- 19 Remote Code Execution Vulnerabilities
- 4 Information Disclosure Vulnerabilities
- 3 Denial of Service Vulnerabilities
- 2 Spoofing Vulnerability
There were 3 zero-day vulnerabilities patched, 1 of which was actively exploited:
CVE-2025-62221 – Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
An actively exploited privilege elevation vulnerability in the Windows Cloud Files Mini Filter Driver that allows attackers to gain SYSTEM privileges.
CVE-2025-64671 – GitHub Copilot for Jetbrains Remote Code Execution Vulnerability
A publicly disclosed GitHub Copilot flaw that allows an attacker to execute commands locally.
CVE-2025-54100 – PowerShell Remote Code Execution Vulnerability
A PowerShell vulnerability that could cause scripts embedded in a webpage to be executed when the page is retrieved using Invoke-WebRequest.
Releases from other software providers include:
- Adobe – updates for ColdFusion, Experience Manager, DNG SDK, Acrobat Reader, and Creative Cloud Desktop.
- Fortinet – updates for multiple products, including a critical FortiCloud SSO Login Authentication Bypass flaw.
- Google – Android’s December security bulletin, which includes fixes for two actively exploited vulnerabilities.
- Ivanti – patches as part of its December 2025 Patch Tuesday updates, which include a fix for a 9.6/10 Stored XSS flaw in Ivanti Endpoint Manager.
- React – updates for a critical RCE flaw in React Server Components. The flaw, dubbed React2Shell, is now widely exploited in attacks.
- SAP – updates for multiple products, including a fix for a 9.9/10 code injection flaw in SAP Solution Manager.
FULL LIST OF KNOWN PATCHES
| Vulnerable Service | CVE ID | Title | Severity |
| Application Information Services | CVE-2025-62572 | Application Information Service Elevation of Privilege Vulnerability | Important |
| Azure Monitor Agent | CVE-2025-62550 | Azure Monitor Agent Remote Code Execution Vulnerability | Important |
| Copilot | CVE-2025-64671 | GitHub Copilot for Jetbrains Remote Code Execution Vulnerability | Important |
| Microsoft Brokering File System | CVE-2025-62569 | Microsoft Brokering File System Elevation of Privilege Vulnerability | Important |
| Microsoft Brokering File System | CVE-2025-62469 | Microsoft Brokering File System Elevation of Privilege Vulnerability | Important |
| Microsoft Edge (Chromium-based) | CVE-2025-13634 | Chromium: CVE-2025-13634 Inappropriate implementation in Downloads | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13721 | Chromium: CVE-2025-13721 Race in v8 | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13630 | Chromium: CVE-2025-13630 Type Confusion in V8 | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13631 | Chromium: CVE-2025-13631 Inappropriate implementation in Google Updater | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13632 | Chromium: CVE-2025-13632 Inappropriate implementation in DevTools | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13633 | Chromium: CVE-2025-13633 Use after free in Digital Credentials | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13638 | Chromium: CVE-2025-13638 Use after free in Media Stream | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13639 | Chromium: CVE-2025-13639 Inappropriate implementation in WebRTC | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13640 | Chromium: CVE-2025-13640 Inappropriate implementation in Passwords | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13637 | Chromium: CVE-2025-13637 Inappropriate implementation in Downloads | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13720 | Chromium: CVE-2025-13720 Bad cast in Loader | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13635 | Chromium: CVE-2025-13635 Inappropriate implementation in Downloads | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2025-13636 | Chromium: CVE-2025-13636 Inappropriate implementation in Split View | Unknown |
| Microsoft Edge for iOS | CVE-2025-62223 | Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability | Low |
| Microsoft Exchange Server | CVE-2025-64666 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Important |
| Microsoft Exchange Server | CVE-2025-64667 | Microsoft Exchange Server Spoofing Vulnerability | Important |
| Microsoft Graphics Component | CVE-2025-64670 | Windows DirectX Information Disclosure Vulnerability | Important |
| Microsoft Office | CVE-2025-62554 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office | CVE-2025-62557 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office Access | CVE-2025-62552 | Microsoft Access Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62560 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62563 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62561 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62564 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62553 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62556 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Outlook | CVE-2025-62562 | Microsoft Outlook Remote Code Execution Vulnerability | Critical |
| Microsoft Office SharePoint | CVE-2025-64672 | Microsoft SharePoint Server Spoofing Vulnerability | Important |
| Microsoft Office Word | CVE-2025-62558 | Microsoft Word Remote Code Execution Vulnerability | Important |
| Microsoft Office Word | CVE-2025-62559 | Microsoft Word Remote Code Execution Vulnerability | Important |
| Microsoft Office Word | CVE-2025-62555 | Microsoft Word Remote Code Execution Vulnerability | Important |
| Storvsp.sys Driver | CVE-2025-64673 | Windows Storage VSP Driver Elevation of Privilege Vulnerability | Important |
| Windows Camera Frame Server Monitor | CVE-2025-62570 | Windows Camera Frame Server Monitor Information Disclosure Vulnerability | Important |
| Windows Client-Side Caching (CSC) Service | CVE-2025-62466 | Windows Client-Side Caching Elevation of Privilege Vulnerability | Important |
| Windows Cloud Files Mini Filter Driver | CVE-2025-62457 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important |
| Windows Cloud Files Mini Filter Driver | CVE-2025-62454 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important |
| Windows Cloud Files Mini Filter Driver | CVE-2025-62221 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2025-62470 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important |
| Windows Defender Firewall Service | CVE-2025-62468 | Windows Defender Firewall Service Information Disclosure Vulnerability | Important |
| Windows DirectX | CVE-2025-62463 | DirectX Graphics Kernel Denial of Service Vulnerability | Important |
| Windows DirectX | CVE-2025-62465 | DirectX Graphics Kernel Denial of Service Vulnerability | Important |
| Windows DirectX | CVE-2025-62573 | DirectX Graphics Kernel Elevation of Privilege Vulnerability | Important |
| Windows DWM Core Library | CVE-2025-64679 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important |
| Windows DWM Core Library | CVE-2025-64680 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important |
| Windows Hyper-V | CVE-2025-62567 | Windows Hyper-V Denial of Service Vulnerability | Important |
| Windows Installer | CVE-2025-62571 | Windows Installer Elevation of Privilege Vulnerability | Important |
| Windows Message Queuing | CVE-2025-62455 | Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability | Important |
| Windows PowerShell | CVE-2025-54100 | PowerShell Remote Code Execution Vulnerability | Important |
| Windows Projected File System | CVE-2025-62464 | Windows Projected File System Elevation of Privilege Vulnerability | Important |
| Windows Projected File System | CVE-2025-55233 | Windows Projected File System Elevation of Privilege Vulnerability | Important |
| Windows Projected File System | CVE-2025-62462 | Windows Projected File System Elevation of Privilege Vulnerability | Important |
| Windows Projected File System | CVE-2025-62467 | Windows Projected File System Elevation of Privilege Vulnerability | Important |
| Windows Projected File System Filter Driver | CVE-2025-62461 | Windows Projected File System Elevation of Privilege Vulnerability | Important |
| Windows Remote Access Connection Manager | CVE-2025-62474 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | Important |
| Windows Remote Access Connection Manager | CVE-2025-62472 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | Important |
| Windows Resilient File System (ReFS) | CVE-2025-62456 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-62549 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-62473 | Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-64678 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Important |
| Windows Shell | CVE-2025-62565 | Windows File Explorer Elevation of Privilege Vulnerability | Important |
| Windows Shell | CVE-2025-64661 | Windows Shell Elevation of Privilege Vulnerability | Important |
| Windows Shell | CVE-2025-64658 | Windows File Explorer Elevation of Privilege Vulnerability | Important |
| Windows Storage VSP Driver | CVE-2025-59517 | Windows Storage VSP Driver Elevation of Privilege Vulnerability | Important |
| Windows Storage VSP Driver | CVE-2025-59516 | Windows Storage VSP Driver Elevation of Privilege Vulnerability | Important |
| Windows Win32K – GRFX | CVE-2025-62458 | Win32k Elevation of Privilege Vulnerability | Important |
GLOSSARY
- Authentication – proving who you are so you can be given access to what you need/have rights to.
- MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
- Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
- Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
- Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
- Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
- DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
- Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
- CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
- Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
- Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
- Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
- Information Disclosure Vulnerabilities – allow the wrong people access to your data.
- Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
- Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.
If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.