actively-exploited-vulnerabilitygovernment-vulnerability-catalogendpoint-software-vulnerabilitywidely-deployed-product-advisory

Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability (CVE-2025-62221)

Active Exploitation · 4 sources · Updated 4mo ago · First seen Dec 12, 2025

Microsoft released a security update in December 2025 addressing a critical privilege escalation vulnerability in the Windows Cloud Files Mini Filter Driver, tracked as CVE-2025-62221. This flaw allows authenticated local attackers to elevate privileges to SYSTEM by exploiting a use-after-free condition in the kernel driver, which arises when the driver fails to reset a pointer after releasing a kernel object. The vulnerability has a CVSS score of 7.8 and has been actively exploited in the wild, prompting urgent patching recommendations from security researchers and vendors.

The December 2025 Patch Tuesday included fixes for 57 vulnerabilities across Microsoft products, but CVE-2025-62221 was highlighted as one of the most severe due to its exploitation status and potential impact on enterprise environments. Security advisories emphasized the need for immediate patching, as the vulnerability was included in CISA's Known Exploited Vulnerabilities catalog and listed among the most exploited vulnerabilities of the year. Organizations are urged to apply the update promptly to mitigate the risk of privilege escalation attacks leveraging this flaw.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Dec 11, 2025 – Dec 30, 2025

Dec 30, 202510mo ago
CISA sets December 30 deadline to remediate CVE-2025-62221
Alongside the KEV listing, CISA set a remediation deadline of 2025-12-30 for federal agencies to address the Windows Cloud Files Mini Filter vulnerability. The agency warned that unpatched systems faced a high risk of privilege escalation and broader compromise.
Dec 14, 202510mo ago
CISA adds CVE-2025-62221 to the KEV catalog
CISA added CVE-2025-62221 to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The agency required federal civilian agencies to remediate the issue under BOD 22-01.
Dec 11, 202511mo ago
Microsoft discloses CVE-2025-54100 PowerShell RCE zero-day
Microsoft also disclosed CVE-2025-54100, a remote code execution vulnerability in Windows PowerShell. The flaw could be exploited through social engineering, but the references state it had not yet been observed in active attacks at the time of disclosure.
Dec 11, 202511mo ago
Microsoft discloses CVE-2025-62221 as an exploited Windows zero-day
Microsoft's December updates included CVE-2025-62221, a use-after-free elevation-of-privilege flaw in the Windows Cloud Files Mini Filter Driver. The vulnerability was reported as actively exploited in the wild and could allow a local attacker to gain SYSTEM privileges.
Dec 11, 202511mo ago
Microsoft releases December 2025 security updates for 57 vulnerabilities
In December 2025, Microsoft issued its monthly security updates addressing 57 vulnerabilities across Windows, Office, Exchange Server, Azure, and related products. The release included multiple critical flaws and zero-days, and Microsoft urged organizations to patch affected systems immediately.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Windows Cloud Files Mini Filter Driver Use-After-Free Privilege Escalation (CVE-2025-62221)

Affected products

1 linked

Windows

Organizations

1 linked

Microsoft Corporation

Observables

5 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Dec 14, 2025

CISA Warns of Windows Cloud Files Mini Filter 0-Day Vulnerability Exploited in AttacksOpen source ↗

Cyber Security NewsNews · Dec 12, 2025

Top 20 Most Exploited Vulnerabilities of 2025: A Comprehensive AnalysisOpen source ↗

Socprime BlogNews · Dec 11, 2025

CVE-2025-62221 and CVE-2025-54100: Windows Elevation of Privilege and RCE Zero-Day Vulnerabilities PatchedOpen source ↗

Nsfocus GlobalNews · Dec 11, 2025

Microsoft’s December Security Update of High-Risk Vulnerability Notice for Multiple ProductsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

actively-exploited-vulnerabilitygovernment-vulnerability-catalogendpoint-software-vulnerabilitywidely-deployed-product-advisory

Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability (CVE-2025-62221)

Active Exploitation · 4 sources · Updated 4mo ago · First seen Dec 12, 2025

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Dec 11, 2025 – Dec 30, 2025

Dec 30, 202510mo ago
CISA sets December 30 deadline to remediate CVE-2025-62221
Alongside the KEV listing, CISA set a remediation deadline of 2025-12-30 for federal agencies to address the Windows Cloud Files Mini Filter vulnerability. The agency warned that unpatched systems faced a high risk of privilege escalation and broader compromise.
Dec 14, 202510mo ago
CISA adds CVE-2025-62221 to the KEV catalog
CISA added CVE-2025-62221 to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The agency required federal civilian agencies to remediate the issue under BOD 22-01.
Dec 11, 202511mo ago
Microsoft discloses CVE-2025-54100 PowerShell RCE zero-day
Microsoft also disclosed CVE-2025-54100, a remote code execution vulnerability in Windows PowerShell. The flaw could be exploited through social engineering, but the references state it had not yet been observed in active attacks at the time of disclosure.
Dec 11, 202511mo ago
Microsoft discloses CVE-2025-62221 as an exploited Windows zero-day
Microsoft's December updates included CVE-2025-62221, a use-after-free elevation-of-privilege flaw in the Windows Cloud Files Mini Filter Driver. The vulnerability was reported as actively exploited in the wild and could allow a local attacker to gain SYSTEM privileges.
Dec 11, 202511mo ago
Microsoft releases December 2025 security updates for 57 vulnerabilities
In December 2025, Microsoft issued its monthly security updates addressing 57 vulnerabilities across Windows, Office, Exchange Server, Azure, and related products. The release included multiple critical flaws and zero-days, and Microsoft urged organizations to patch affected systems immediately.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →